Simplify the specifications list template.

Similar to e56c3889

 (#270), but for the list of subpages in
/spec/v0.1/index. This change replace the "automatic" code with a manual
list, which is much easier to understand and maintain.

No content change. The only HTML change is to switch from absolute to
relative links and to eliminate empty `<li>` elements.

NOTE: Neither the original nor new code correctly handled displaying
more than one specification version. This commit adds a TODO making it
clear that it doesn't work.
Signed-off-by: Mark Lodato <lodato@google.com>

Simplify the nav template

The old nav system had several drawbacks:

- It tried to "automatically" list all of the specification pages using
  the `order` field of each page, but this didn't work correctly and was
  a pain to maintain. Plus the liquid code was complicated.
- There was no way to customize the link text (always page title) or to
  link to custom URLs (e.g. /provenance instead of /provenance/v0.2).
- The mobile and non-mobile templates were duplicate but slightly
  different, which may lead to bugs in the future.

Now we have an explicit configuration in _data/nav.yml and use the same
template for both mobile and non-mobile nav bars. This should be easier
to maintain.
Signed-off-by: Mark Lodato <lodato@google.com>

Prefer relative links to simplify the content.

This fixes the pages when rendered on GitHub and generally makes
the source easier to read.
Signed-off-by: Mark Lodato <lodato@google.com>

Add SLSA logo without text.

All of the previously checked-in images have text next to them. This new
version makes it easier to convert to other formats, such as our GitHub
org profile (which I just did).
Signed-off-by: Mark Lodato <lodato@google.com>

Clean up jekyll config and add dependabot.

Signed-off-by: Mark Lodato <lodato@google.com>

Reference: https://github.com/jekyll/github-metadata/blob/master/docs/authentication.md#2-netrc

Signed-off-by: Mark Lodato <lodato@google.com>

Signed-off-by: Mark Lodato <lodato@google.com>

- Update environment to match GitHub Pages exactly.
- Update the instructions to fully explain how to test locally.
- Remove the .DS_Store file, which should not have been checked in.
- Exclude some files from Jekyll that shouldn't be published to the web.
Signed-off-by: Mark Lodato <lodato@google.com>

Signed-off-by: Mark Lodato <lodato@google.com>

Explain how SLSA can help with typosquatting.

Previously the doc said flatly that typosquatting was out of scope. But
SLSA can be a partial mitigation, so we should clarify that.
Signed-off-by: Mark Lodato <lodato@google.com>

Bump actions/setup-node from 2.5.0 to 2.5.1

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 2.5.0 to 2.5.1.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/04c56d2f954f1e4c69436aa54cfef261a018f458...1f8c6b94b26d0feae1e387ca63ccbdc44d27b561

)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-type: direct:production
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Adds editable resources (threat diagram and badges)

Fixes custom font path in production env

Signed-off-by: Dev Morgan <disfordisford@gmail.com>

Signed-off-by: Dev Morgan <disfordisford@gmail.com>

slsa.dev overhaul

There were several absolute paths that work on the production site and
the development server but not on a personal fork's GitHub Pages. The
fix is to use either relative paths or {{site.baseurl}}.
Signed-off-by: Mark Lodato <lodato@google.com>

Signed-off-by: Dev Morgan <disfordisford@gmail.com>

Signed-off-by: Dev Morgan <disfordisford@gmail.com>

Signed-off-by: Dev Morgan <disfordisford@gmail.com>

README: Add steering committee list, fix GH alias.

Run Google Analytics in "denied consent" mode.

Add the newly creating SLSA steering committee mailing list to the
README file to allow people to easily contact the steering committee.
This is not on the slsa.dev site since we'd prefer users to go through
public channels.

Also fix the GitHub team name (no "teams/") in the README.
Signed-off-by: Mark Lodato <lodato@google.com>

This stops cookies from loading so that we don't need a GDPR cookie
banner.
Signed-off-by: Mark Lodato <lodato@google.com>

Typo correction

Signed-off-by: coldclimate <>

Fix a typo in provenance definition.

`invocation.configSource.uri` should be of type ResourceURI.
Signed-off-by: Adam Wu <zhenyuwu@google.com>

Signed-off-by: Kim Lewandowski <kim.m.lewandowski@gmail.com>

provenance: fix name of configSource in descriptions

There are several mentions of invocation.sourceConfig in the descriptions
of fields in the provenance format. However, the field name is
configSource.
Signed-off-by: Joshua Lock <jlock@vmware.com>