feat: Finalize the SLSA v1.0 provenance format #221
Conversation
Signed-off-by: Asra Ali <[email protected]>
|
Also want to loop in @sherzberg-1 as fyi. Just want to make sure the intoto provenance statement can be serialized and deserialized to grafeas proto. |
Signed-off-by: Asra Ali <[email protected]>
|
Thanks @chuangw6 , will make sure they can serialize/deserialize back and forth. |
|
LGTM |
|
Hi @adityasaky , |
There was a problem hiding this comment.
Thanks @asraa! I think we can merge this overall.
However, I do want to hear from @in-toto/attestation-maintainers re using the models generated for ResourceDescriptor (and possibly Statement etc as well).
| // ResourceDescriptor describes a particular software artifact or resource | ||
| // (mutable or immutable). | ||
| // See https://github.com/in-toto/attestation/blob/main/spec/v1.0/resource_descriptor.md | ||
| type ResourceDescriptor struct { |
There was a problem hiding this comment.
Thoughts on using ResourceDescriptor from https://github.com/in-toto/attestation/blob/main/go/v1/resource_descriptor.pb.go?
There was a problem hiding this comment.
I think that's a good idea. But given the proto only defines ResourceDescriptor and misses many other fields of SLSA v1 predicate, should we move on with current approach and cut a release first, and later switch over to models generated from proto once all v1 predicate fields are well defined in attestation repo?
There was a problem hiding this comment.
To my understanding, SLSA already defines full protos for SLSA provenance v1: https://github.com/slsa-framework/slsa/tree/main/docs/provenance/schema/v1/provenance.proto
We (in-toto attestation maintainers) were operating under the assumption that SLSA will maintain all SLSA-related predicate spec and proto versions. Based on your comment here, it sounds like there's an expectation that the in-toto attestation repo should maintain (a separate copy) of SLSA provenance v1 protos?
There was a problem hiding this comment.
Oh, I was only looking at https://github.com/in-toto/attestation/tree/main/protos/in_toto_attestation/v1. I thought intoto will define its own proto again.
If intoto can reuse the proto from SLSA, that would be great. I have no option on this :D I'd defer intoto maintainers to decide this.
I am looking forward to seeing an intoto-golang release for SLSA v1!
There was a problem hiding this comment.
Got it :) At least my preference would be to use the SLSA-defined protos for generating the language bindings for the predicate, so this integration is something we should definitely discuss on our end.
There was a problem hiding this comment.
Sounds good to me! Is there a target date we can expect a release with the slsa v1 support? Thanks!
There was a problem hiding this comment.
I think I'm okay to merge this PR and then next into main and cut a release to unblock other tools. My inclination is to switch it out behind the scenes later as we want to do that for multiple models, not just SLSA Provenance.
There was a problem hiding this comment.
+1 with @adityasaky can merge for now and switch behind the scenes in another release.
| // ResourceDescriptor describes a particular software artifact or resource | ||
| // (mutable or immutable). | ||
| // See https://github.com/in-toto/attestation/blob/main/spec/v1.0/resource_descriptor.md | ||
| type ResourceDescriptor struct { |
There was a problem hiding this comment.
I think I'm okay to merge this PR and then next into main and cut a release to unblock other tools. My inclination is to switch it out behind the scenes later as we want to do that for multiple models, not just SLSA Provenance.
| // ResourceDescriptor describes a particular software artifact or resource | ||
| // (mutable or immutable). | ||
| // See https://github.com/in-toto/attestation/blob/main/spec/v1.0/resource_descriptor.md | ||
| type ResourceDescriptor struct { |
There was a problem hiding this comment.
+1 with @adityasaky can merge for now and switch behind the scenes in another release.
Fixes issue:
Fixes #197
Description:
Finalizes the SLSA v1.0 provenance format.
@adityasaky it would be great to merge the
nextbranch into main soon and do a minor release with the SLSA v1 feature!Please verify and check that the pull request fulfills the following
requirements:
cc @MarkLodato @laurentsimon @chuangw6