SLSA v1.0: shift emphasis to expectations + verification in levels.md #503
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
✅ Deploy Preview for slsa ready!
To edit notification comments on pull requests, go to your Netlify site settings. |
joshuagl
reviewed
Oct 13, 2022
MarkLodato
force-pushed
the
v1-expectations
branch
from
8e18925
to
e30efdc
Compare
|
Thanks. I updated the language as suggested and rebased onto the latest version of #502. |
MarkLodato
force-pushed
the
v1-expectations
branch
from
e30efdc
to
02510ea
Compare
Previously the specification only required the publication of provenance but did not say anything about its verification. The latter is what actually detects or prevents attacks, so this was a big gap. Futhermore, the previous "scripted build" requirement did not have a clear reason why it was included. Now there is explicit language around: - Defining an expectation of how the package should be built, replacing the previous "scripted build" requirement. - Verifying that the provenance meets expectations. NOTE: This commit only changes levels.md. A future commit will make an equivalent change to the rest of the spec, e.g. requirements.md. Signed-off-by: Mark Lodato <[email protected]>
MarkLodato
force-pushed
the
v1-expectations
branch
from
02510ea
to
de5117a
Compare
joshuagl
approved these changes
Oct 17, 2022
4 tasks
Yes. I assume that would be a necessary part of #46. This PR here is only a first step. |
abacchi
approved these changes
Oct 17, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Preview: https://deploy-preview-503--slsa.netlify.app/spec/v1.0/levels
(As discussed in #130 and the Specification SIG meeting)
Previously the specification only required the publication of provenance but did not say anything about its verification. The latter is what actually detects or prevents attacks, so this was a big gap. Futhermore, the previous "scripted build" requirement did not have a clear reason why it was included.
Now there is explicit language around:
NOTE: This PR only changes levels.md. A future commit will make an equivalent change to the rest of the spec, e.g. requirements.md.
Related issues (not fully fixed): #46, #130, #371