Add Dependency Ingestion Provenance predicate (v1) - #1
Open
mlieberman85 wants to merge 1 commit into
Open
Conversation
Adds the first predicate schema in this repo: the SLSA Dependency Ingestion Provenance predicate defined by the SLSA Dependency Track. - New file: dependency/v1/dependency.proto — DependencyIngestionProvenance message plus supporting messages (Ingestor, IngestionPlatform, UpstreamRef, IngestionEvent, ResolvedFromRef, Scan/Scanner, IntegrityVerdict, PublisherSignatureVerdict, PolicyEvaluation/Policy, UpstreamAttestationRef, SigningIsolation, IngestionIsolation). - README.md: documents the layout convention <predicate>/<version>/<predicate>.proto, package/go_package/java_package naming conventions, and notes that Build/VSA/Source predicate schemas currently live in slsa-framework/slsa and are expected to migrate here over time. The proto tracks the schema at https://github.com/slsa-framework/slsa/blob/main/spec/dependency-provenance.md and includes a keep-in-sync header comment pointing back to the spec. Enumerable values (scan types, isolation methods, verdict strings) are encoded as string fields rather than enums so implementer-defined values remain extensible without proto changes. Level-based requirements (REQUIRED at L2+, etc.) are documented in the spec, not in the schema; validation of all fields is left to the users of this proto. Signed-off-by: Michael Lieberman <mlieberman85@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the first predicate schema in this repo: the SLSA Dependency Ingestion
Provenance predicate defined by the SLSA Dependency Track
(merged as slsa-framework/slsa#1627).
dependency/v1/dependency.proto—DependencyIngestionProvenancemessage plus supporting messages (Ingestor, IngestionPlatform, UpstreamRef,
IngestionEvent, ResolvedFromRef, Scan/Scanner, IntegrityVerdict,
PublisherSignatureVerdict, PolicyEvaluation/Policy, UpstreamAttestationRef,
SigningIsolation, IngestionIsolation).
README.md: documents the layout convention<predicate>/<version>/<predicate>.proto, package / go_package /java_package naming, and notes that Build / VSA / Source predicate schemas
currently live in slsa-framework/slsa and are expected to migrate here
over time.
Conventions established here
Since this is the first substantive PR to this repo, it also sets a few
conventions worth naming explicitly (see the README):
<predicate>/<version>/<predicate>.protoslsa.<predicate>.<version>(e.g.slsa.dependency.v1)go_package:github.com/slsa-framework/protos/<predicate>/<version>java_package:dev.slsa.<predicate>.<version>string(notenum) for implementer extensibilitythe schema; validation is left to the users of these protos.
Happy to iterate on any of these.
Related
content: Rename upstreamProvenance to upstreamAttestations slsa#1648 — this proto reflects the
renamed shape.
Test plan
protoc --proto_path=. --descriptor_set_out=/dev/null dependency/v1/dependency.proto— compiles cleanly underprotoc 35.1buf.yaml+ CI (lint, breaking-change detection) as a separate PR