Is the verification result cacheable?

[jgsuess]

It seems that a lot of time is spent in running the SLSA verifier on definitive maven versions. Are these runs required? If a version is definitive and final and its hash has not changed, then the verification result would be the same every time? Or am I seeing that wrong?

2023-06-28 04:33:19,963 [INFO] Successfully verified artifact: _VerifyArtifactResultType.PASSED
2023-06-28 04:33:24,373 [INFO] Storing SLSA verifier output for build/repo/micronaut-runtime-osx/3.9.4/micronaut-runtime-osx-3.9.4.jar to /home/macaron/output/output/build_log/micronaut-core.slsa_verifier.log

[behnazh-w]

Yes, it's possible to cache the results, and we are working on it as part of the new data model milestone.