Drew Roen

The video on this page is private

1

Hello! I just wanted to point out the video on this page is marked private and cannot be viewed. --- #### Document Details ⚠ *Do not edit this section. It...

SPIKE: Utilize cocoon's readiness check to verify provenance exists

1

Cocoon has a [readiness check](https://cs.opensource.google/flutter/cocoon/+/main:app_dart/lib/src/request_handlers/readiness_check.dart) that is used to verify if the server is ready to handle requests. We could utilize this check to ensure that the server has associated...

Refresh Flutter Cirrus Key

1

Had a note in my calendar that this week the flutter cirrus key needs to be refreshed. This bug is just to track that.

Slsa-verifier v2.2.0 failing to install on Google Cloud Build image after Dependabot updates

9

We are installing slsa-verifier in our CI system for [flutter/cocoon](https://github.com/flutter/cocoon) based on the documentation provided [here](https://github.com/slsa-framework/slsa-verifier#option-1-install-via-go). We have enabled Dependabot to update the go modules automatically. Last week, Dependabot created...

Update the packaging recipe or script to ensure that the sha of the artifact being created matches the sha of the corresponding release tag

2

Without this protection, it is possible to trigger a packaging build and upload an artifact with a sha that was not tagged as the "official" version. We want to make...