Third Party Verification - Provenance & Attestations

[toderash]

This standalone application is intended to check any verifiable provenance and attestation which is supplied. Example prior art, APIs, similar implementations, and related resources are listed here, but are not considered to be specifically required in the final design of the application.

As described in Provenance & Attestation Checks:

• Check for VDP
• CRA Compliance (basic checks TBD)
• License compatibility
  • Open Definition Licenses API
  • OSI Approved License API
  • Verify GPL compatibility (FSF List)
• Verify contact info
  • Verify email addresses are deliverable: roll our own or use APIs like (e.g.) Verifalia, Email Hippo, or VerifyMail
  • Verify no disposable email addresses; roll our own or use APIs such as Email Hippo or DeBounce
  • Verify URLS provided are live and contain the required contact information
• WordPress Plugin Attestation Github action by John Blackbourn
• Append results to fair-forge-meta per spec

Resulting output to STDOUT is fine, can be piped where we need it later. Output format should be along these lines:

• fair-forge-meta spec
• package-meta