slsa-framework · puerco · Jul 29, 2025 · Jul 29, 2025
diff --git a/actions/get_note/action.yml b/actions/get_note/action.yml
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+# SPDX-License-Identifier: Apache-2.0
+---
 name: Gets data from a git note
 description: Gets data from the git note and stores it in the provided path.
 inputs:

diff --git a/actions/slsa_with_provenance/action.yml b/actions/slsa_with_provenance/action.yml
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+# SPDX-License-Identifier: Apache-2.0
+---
 name: SLSA Source Provenance Creator
 
 description: Creates SLSA Source Track Provenance

diff --git a/actions/store_note/action.yml b/actions/store_note/action.yml
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+# SPDX-License-Identifier: Apache-2.0
+---
 name: Store data in git notes
 description: Stores provided data in a git note for the current commit.
 inputs:

diff --git a/internal/cmd/audit.go b/internal/cmd/audit.go
@@ -1,6 +1,6 @@
-/*
-Copyright © 2025 NAME HERE <EMAIL ADDRESS>
-*/
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package cmd
 
 import (

diff --git a/internal/cmd/auth.go b/internal/cmd/auth.go
@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright 2025 Carabiner Systems, Inc
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
 // SPDX-License-Identifier: Apache-2.0
 
 package cmd

diff --git a/internal/cmd/checklevel.go b/internal/cmd/checklevel.go
@@ -1,6 +1,6 @@
-/*
-Copyright © 2025 NAME HERE <EMAIL ADDRESS>
-*/
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package cmd
 
 import (

diff --git a/internal/cmd/checklevelprov.go b/internal/cmd/checklevelprov.go
@@ -1,6 +1,6 @@
-/*
-Copyright © 2025 NAME HERE <EMAIL ADDRESS>
-*/
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package cmd
 
 import (

diff --git a/internal/cmd/checktag.go b/internal/cmd/checktag.go
@@ -1,6 +1,6 @@
-/*
-Copyright © 2025 NAME HERE <EMAIL ADDRESS>
-*/
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package cmd
 
 import (

diff --git a/internal/cmd/createpolicy.go b/internal/cmd/createpolicy.go
@@ -1,6 +1,6 @@
-/*
-Copyright © 2025 NAME HERE <EMAIL ADDRESS>
-*/
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package cmd
 
 import (

diff --git a/internal/cmd/logo.go b/internal/cmd/logo.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package cmd
 
 var logo = []string{

diff --git a/internal/cmd/options.go b/internal/cmd/options.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package cmd
 
 import (

diff --git a/internal/cmd/policy.go b/internal/cmd/policy.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package cmd
 
 import (

diff --git a/internal/cmd/prov.go b/internal/cmd/prov.go
@@ -1,6 +1,6 @@
-/*
-Copyright © 2025 NAME HERE <EMAIL ADDRESS>
-*/
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package cmd
 
 import (

diff --git a/internal/cmd/root.go b/internal/cmd/root.go
@@ -1,6 +1,6 @@
-/*
-Copyright © 2025 NAME HERE <EMAIL ADDRESS>
-*/
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package cmd
 
 import (

diff --git a/internal/cmd/setup.go b/internal/cmd/setup.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package cmd
 
 import (

diff --git a/internal/cmd/status.go b/internal/cmd/status.go
@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright 2025 Carabiner Systems, Inc
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
 // SPDX-License-Identifier: Apache-2.0
 
 package cmd

diff --git a/internal/cmd/verifycommit.go b/internal/cmd/verifycommit.go
@@ -1,6 +1,6 @@
-/*
-Copyright © 2025 NAME HERE <EMAIL ADDRESS>
-*/
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package cmd
 
 import (

diff --git a/internal/tools.go b/internal/tools.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 //go:build tools
 
 // This file forces the import of modules used for build scripts and tests

diff --git a/main.go b/main.go
@@ -1,6 +1,6 @@
-/*
-Copyright © 2025 NAME HERE <EMAIL ADDRESS>
-*/
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package main
 
 import (

diff --git a/pkg/attest/log.go b/pkg/attest/log.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package attest
 
 import (

diff --git a/pkg/attest/provenance.go b/pkg/attest/provenance.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package attest
 
 import (

diff --git a/pkg/attest/provenance_test.go b/pkg/attest/provenance_test.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package attest
 
 import (

diff --git a/pkg/attest/sign.go b/pkg/attest/sign.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package attest
 
 import (

diff --git a/pkg/attest/statement.go b/pkg/attest/statement.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package attest
 
 import (

diff --git a/pkg/attest/statement_test.go b/pkg/attest/statement_test.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package attest
 
 import (

diff --git a/pkg/attest/verify.go b/pkg/attest/verify.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package attest
 
 import (

diff --git a/pkg/attest/vsa.go b/pkg/attest/vsa.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package attest
 
 import (

diff --git a/pkg/attest/vsa_test.go b/pkg/attest/vsa_test.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package attest
 
 // TODO: This test package uses some functions that live in provenance_test.go

diff --git a/pkg/audit/audit.go b/pkg/audit/audit.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package audit
 
 import (

diff --git a/pkg/auth/authenticator.go b/pkg/auth/authenticator.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 //go:generate go run github.com/maxbrunsfeld/counterfeiter/v6 -generate
 
 package auth

diff --git a/pkg/auth/implementation.go b/pkg/auth/implementation.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package auth
 
 import (

diff --git a/pkg/ghcontrol/checklevel.go b/pkg/ghcontrol/checklevel.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package ghcontrol
 
 import (

diff --git a/pkg/ghcontrol/checklevel_test.go b/pkg/ghcontrol/checklevel_test.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package ghcontrol
 
 import (

diff --git a/pkg/ghcontrol/connection.go b/pkg/ghcontrol/connection.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package ghcontrol
 
 import (

diff --git a/pkg/ghcontrol/connection_test.go b/pkg/ghcontrol/connection_test.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package ghcontrol
 
 import (

diff --git a/pkg/ghcontrol/git_types.go b/pkg/ghcontrol/git_types.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package ghcontrol
 
 import (

diff --git a/pkg/ghcontrol/notes.go b/pkg/ghcontrol/notes.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package ghcontrol
 
 import (

diff --git a/pkg/ghcontrol/notes_test.go b/pkg/ghcontrol/notes_test.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package ghcontrol
 
 import (

diff --git a/pkg/ghcontrol/options.go b/pkg/ghcontrol/options.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package ghcontrol
 
 var defaultOptions = Options{

diff --git a/pkg/policy/marshalers.go b/pkg/policy/marshalers.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package policy
 
 import "encoding/json"

diff --git a/pkg/policy/policy.go b/pkg/policy/policy.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package policy
 
 import (

diff --git a/pkg/policy/policy_test.go b/pkg/policy/policy_test.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package policy
 
 import (

diff --git a/pkg/provenance/predicate.go b/pkg/provenance/predicate.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package provenance
 
 import "encoding/json"

diff --git a/pkg/repo/clone.go b/pkg/repo/clone.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package repo
 
 import (

diff --git a/pkg/repo/implementation.go b/pkg/repo/implementation.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 //go:generate go run github.com/maxbrunsfeld/counterfeiter/v6 -generate
 package repo
 

diff --git a/pkg/repo/options/options.go b/pkg/repo/options/options.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package options
 
 import "errors"

diff --git a/pkg/repo/options/options_test.go b/pkg/repo/options/options_test.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package options
 
 import (

diff --git a/pkg/repo/pullrequest.go b/pkg/repo/pullrequest.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package repo
 
 import (

diff --git a/pkg/slsa/slsa_types.go b/pkg/slsa/slsa_types.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package slsa
 
 import (

diff --git a/pkg/sourcetool/backends/attestation/notes/backend.go b/pkg/sourcetool/backends/attestation/notes/backend.go
@@ -1,6 +1,8 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 // Package notes implements an attestation storage backend that reads from
 // git commit notes
-
 package notes
 
 import (

diff --git a/pkg/sourcetool/backends/vcs/github/github.go b/pkg/sourcetool/backends/vcs/github/github.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package github
 
 import (

diff --git a/pkg/sourcetool/backends/vcs/github/manage.go b/pkg/sourcetool/backends/vcs/github/manage.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package github
 
 import (

diff --git a/pkg/sourcetool/implementation.go b/pkg/sourcetool/implementation.go
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
 package sourcetool
 
 import (