Point to artifact verification from the security policy - #8

Part 2 of the Security section rollout. The site side is live: SpineEventEngine/documentation#88 and SpineEventEngine/SpineEventEngine.github.io#554.

What changed in SECURITY.md

• New section, "Verifying our artifacts", after "Third-party components". It's a pointer with no commands:

  • the artifacts we publish to Maven repositories carry SLSA build provenance;
  • what checking it proves (built by us from a protected branch, unchanged since), and that it doesn't mean the artifact is free of vulnerabilities;
  • older artifacts may carry no provenance, or provenance at a lower level.

  The full instructions live at https://spine.io/docs/security/verifying-artifacts/. This follows the pattern of Argo CD, Kubernetes and Kyverno: the site holds the procedure, and SECURITY.md points to it.

• CVD Policy link now points to its canonical URL, https://spine.io/docs/security/cvd-policy/. The old /cvd-policy/ keeps redirecting there for links elsewhere.

Why it's worded this way

• It says "artifacts we publish to Maven repositories", not "Spine", so it stays true in repositories that publish nothing. This file is the default SECURITY.md for every repository of the organization.
• It ties "Build Level 3" to the mechanism rather than presenting it as a certification.
• It covers legacy artifacts, so someone whose older JAR fails to verify isn't alarmed.

"From a protected branch" holds for the repositories checked: master of .github and base-libraries has a ruleset that blocks deletion and force-pushes and requires pull requests.

Checks

• All three link targets return 200.
• GitHub renders the new section, with all references resolved.
• The Security policy page on spine.io renders this file at build time; Hugo's Goldmark renders the new section the same way, and it appears in the page's table of contents.

After merging

Run the spine.io Deploy to GitHub Pages workflow by hand (Run workflow on master), so https://spine.io/docs/security/policy/ picks up this version without waiting for the next commit there.

🤖 Generated with Claude Code