[sv-service 5] Show source verification next to the source link - #247
Open
mdgeorge4153 wants to merge 1 commit into
Open
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
mdgeorge4153
force-pushed
the
mdgeorge/source-verification-2-sv-display
branch
from
July 23, 2026 19:29
bd4e255 to
d41463f
Compare
mdgeorge4153
changed the title
mdgeorge4153
force-pushed
the
mdgeorge/source-verification-2-sv-display
branch
from
July 24, 2026 11:37
763a614 to
225b8ae
Compare
mdgeorge4153
force-pushed
the
mdgeorge/source-verification-2-sv-display
branch
from
July 24, 2026 18:22
225b8ae to
6d4588f
Compare
mdgeorge4153
force-pushed
the
mdgeorge/source-verification-2-sv-display
branch
from
July 30, 2026 18:24
6d4588f to
c638ea7
Compare
mdgeorge4153
force-pushed
the
mdgeorge/source-verification-2-sv-display
branch
from
July 30, 2026 18:31
c638ea7 to
2b2c567
Compare
mdgeorge4153
force-pushed
the
mdgeorge/source-verification-2-sv-display
branch
from
August 5, 2026 21:03
cee7798 to
9632e8a
Compare
mdgeorge4153
force-pushed
the
mdgeorge/source-verification-2-sv-display
branch
from
August 5, 2026 21:38
9632e8a to
0a26d52
Compare
mdgeorge4153
force-pushed
the
mdgeorge/source-verification-2-sv-display
branch
from
August 6, 2026 16:43
0a26d52 to
bb327ba
Compare
mdgeorge4153
force-pushed
the
mdgeorge/source-verification-2-sv-display
branch
from
August 7, 2026 13:42
bb327ba to
177e5cc
Compare
mdgeorge4153
marked this pull request as ready for review
August 14, 2026 18:34
mdgeorge4153
force-pushed
the
mdgeorge/source-verification-2-sv-display
branch
from
August 14, 2026 21:00
14bb82c to
b68ff58
Compare
mdgeorge4153
force-pushed
the
mdgeorge/source-verification-2-sv-display
branch
from
August 14, 2026 21:18
b68ff58 to
1d3de0e
Compare
mdgeorge4153
force-pushed
the
mdgeorge/source-verification-2-sv-display
branch
from
August 20, 2026 11:06
1d3de0e to
72bb709
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates mvr to display the source verification attestations. Positive matches have an expandable panel that gives details of the verification, while tags that don't have matching attestations have a small note that says that a lack of verification doesn't indicate bad source, just unchecked source. If a package has no attestation for the current commit but does have attestations for other commits, those are listed with links to the diffs.
Both panels have a link to the mvr page for the source verification service. I'm still waiting on multisig for the actual mvr registration for @mysten/source-verification, so that link is dead right now. It will link to https://github.com/MystenLabs/source-verification-service/blob/testnet/v1/move/source-verification/README.md
The PR also changes the source link to point to the actual commit, rather than just to the repo. The text of the link stays the same. Note that this only works for github links, but right now that's experimentally all of them.
Here are some examples for visual review:
Verified —
@mysten/attestations: the tag resolves to the exact commit an attestation covers → green "Verified source code".Verified, then moved —
@pkg/attestations-demo-auditor: the name's tag was bumped past the verified commit (a README-only change) → "Unverified", but the panel lists the earlier verified commit with a diff of what changed since.Unverified —
@ericnordelo/openzeppelin-math: a source link with no source-verification attestation → "Unverified", with the note that this only means unchecked, not known-different.The PR is currently stacked above the PR that adds the security tab, but it doesn't really depend on it (it does depend on the base of the stack). If SV is ready to ship before the security tab is, I'll restack them in the other order, just leaving them stacked this way for now for demo purpsoses.