From ffe516d51bb0e2c237aa8bf8d8744647b9af7fff Mon Sep 17 00:00:00 2001 From: alexander-yevsyukov Date: Thu, 1 Oct 2026 15:07:24 +0100 Subject: [PATCH] Point to artifact verification from the security policy Add a "Verifying our artifacts" section. It says that the artifacts we publish to Maven repositories carry SLSA build provenance, what checking it proves and what it doesn't, and that older versions may carry none. The command and the details live on spine.io, at Documentation > Security > Verifying artifacts, which the section links to. Also point the CVD Policy link to its new address, https://spine.io/docs/security/cvd-policy/. The old one redirects there. Co-Authored-By: Claude Opus 5.5 --- SECURITY.md | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 18a7aee..957bdd7 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -44,4 +44,22 @@ Spine incorporates third-party components and other dependencies. Where a vulner such a component affects Spine, we treat it as an issue affecting our product and address it accordingly. Please see the [Policy][cvd-policy] for the details. -[cvd-policy]: https://spine.io/cvd-policy/ +Verifying our artifacts +----------------------- +The artifacts we publish to Maven repositories carry signed build provenance: a record, in +the [SLSA][slsa] format, of the repository, branch, and workflow that built them. This +covers JARs, POMs, Gradle module metadata, and the SBOM published next to each module. The +builds run on GitHub-hosted runners, in a reusable workflow that the building repository +cannot modify, which meets SLSA v1.0 Build Level 3. + +With the provenance, you can check that a file you downloaded was built by us from a +protected branch and has not changed since. It does not say that the artifact is free of +vulnerabilities; to report a vulnerability, please follow the instructions above. + +Artifacts published before a repository adopted this process carry no provenance, or +provenance at a lower level. See [Verifying artifacts][verify] for the command and the +versions it applies to. + +[cvd-policy]: https://spine.io/docs/security/cvd-policy/ +[slsa]: https://slsa.dev/spec/v1.0/levels +[verify]: https://spine.io/docs/security/verifying-artifacts/