@Forrin thanks for your interest!

Keep version .02 support?

No strong opinions on this one - personally, I don't see a reason to just update to v1.0, I'm happy with that.

In terms of slsa for containers - cloud.google.com/build/docs/securing-builds/generate-validate-build-provenance#example_output is a decent example for v1 slsa. However, this doesn't have as much detail... but it's more inline with what I see in the slsa spec.

Expanding on the last point.. Some data doesn't map as well into slsa predicate - purge this data?

Yeahhhh, this is tricky - I think if we're upgrading we can reshuffle fields around, etc. But we shouldn't decrease the level of detail. If we do that, we're losing info, and then this would just be a net downgrade.

Do you have an example of some of the data that doesn't fit in neatly? Even if it doesn't fit into a field directly, SLSA still supports custom fields, and we can use those.

The provenance data for a local exporter is not the same as remote. Is that intentional? Seems all local files are included with their digests.

I think local exports should be supported. In particular I'd like to export the provenance data, sign it, and upload it to a different data store.

Each exporter produces different output formats. The remote exporter is producing a container image (where we have image manfests etc), while the local exporter is essentially just the filesystem at the root of the filesystem.

These outputs are different - so yes, they have to have different subjects in the attestation. There is the oci exporter, which exports a container to a local image store - the attestation subjects are more similar to the remote one in this case.

Should support for signing be added? If so, hooking into sigstore libraries may be viable.

This feels like one of the later additions, I guess it's dependent on 1.0 support in the first place? Or maybe it's orthogonal.

That said, totally a fan of this, I like the sound of that approach - I would happily support and follow along with any work in this direction.

SLSA 1.0 Spec support #3684

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions