Mohammad Abdollahpour comments

Results 4 comments of


                                            Mohammad Abdollahpour

feat: verify whether the reported repository can be linked back to the artifact

@behnazh-w thanks for the comments! I'll apply the changes by EOD.

feat: verify whether the reported repository can be linked back to the artifact

> > Is there a plan to add unit testing and integration testing as part of this PR? @behnazh-w > > Yes for sure. The PR needs unit tests and...

feat: verify whether the reported repository can be linked back to the artifact

> > > The core part is added as "repo_verifier" under "repo_finder". "analyzer" calls the "repo_verifier" and adds the info to "dynamic_data". I added a sample check (for maven) that...

feat: verify whether the reported repository can be linked back to the artifact

> Please add the new check to the check table in the [documentation](https://oracle.github.io/macaron/#current-checks-in-macaron) at `docs/source/index.rst`. The SLSA requirement is "Source - [Version controlled](https://slsa.dev/spec/v0.1/requirements#version-controlled)", right?