diff --git a/docs/_data/spec_v1-0/certification-registry.yml b/docs/_data/spec_v1-0/certification-registry.yml deleted file mode 100644 index 0d3379b9e..000000000 --- a/docs/_data/spec_v1-0/certification-registry.yml +++ /dev/null @@ -1,5 +0,0 @@ -- name: "[Example] Foo Build System" - slsa_level: 2 - website: https://example.com/foo-build-system - self_attestation: https://example.com/foo-build-system/attestation - public_key: https://example.com/foo-build-system/public-key diff --git a/docs/spec/v1.0/certification-registry.md b/docs/spec/v1.0/certification-registry.md deleted file mode 100644 index e456ffbb1..000000000 --- a/docs/spec/v1.0/certification-registry.md +++ /dev/null @@ -1,21 +0,0 @@ -# Certification Registry - -## **TODO** - -- [ ] Add a link to the SLSA Self-Certification Questionnaire. - -This page lists build systems that have certified conformance to the -[SLSA Framework Version 1.0](index.md) by following the -[Certification](certification.md) process. - -## Tier 1 - Self-certified conformance - -| Build system | SLSA level | Website | Self-certification | Public key | -| ------------ | ---------- | ------- | ---------------- | ---------- | -{%- for build_system in site.data.spec_v1-0.certification-registry %} -| {{ build_system.name }} | {{ build_system.slsa_level }} | [{{build_system.website }}]({{ build_system.website }}) | [{{build_system.self_attestation }}]({{ build_system.self_attestation }}) | [{{build_system.public_key }}]({{ build_system.public_key }}) | -{%- endfor %} - -## Tier 2 - Third-party verified conformance [TODO] - -> **Note:** This tier is not yet implemented. diff --git a/docs/spec/v1.0/certification.md b/docs/spec/v1.0/certification.md index 724fc908c..b3cbd9549 100644 --- a/docs/spec/v1.0/certification.md +++ b/docs/spec/v1.0/certification.md @@ -2,13 +2,14 @@ ## **TODO** +- [ ] Create a certification registry repo and add links in this doc. - [ ] Create a self-certification questionnaire. - [ ] Add a link to the SLSA Self-Certification Questionnaire. ## Overview > User's looking for certifications for a particular build system can find them -> on the [Certification Registry](certification-registry.md). +> on the Certification Registry (**TODO:** create repo for certification registry and link here). The SLSA Framework defines a series of levels that describe increasing security guarantees. The certification process is intended to verify that a build system @@ -24,7 +25,7 @@ trust they can place in a build system. The following tiers are defined: ### Tier 0 - No evidence of conformance > **Note:** If a build system is not listed in the -> [Certification Registry](certification-registry.md), you should assume that it +> Certification Registry (**TODO:** create repo for certification registry and link here), you should assume that it > is in Tier 0. The Tier 0 trust tier is the lowest level of trust. Build systems in this tier @@ -36,7 +37,7 @@ build system before using it. ### Tier 1 - Self-certified conformance > Build systems in this trust tier are listed in the -> [Certification Registry](certification-registry.md). +> Certification Registry (**TODO:** create repo for certification registry and link here). Tier 1 signifies that a build system owner has self-certified their build system to a particular SLSA level. This certification is intended to be a reasonable @@ -55,8 +56,7 @@ The self-certification process includes the following steps: and publishes it on their website. 3. The build system owner publishes their public key to a public key server. 4. The build system owner submits a pull request to add their build system to - the [Certification Registry](certification-registry.md). **[TODO] provide PR - template link** + the Certification Registry (**TODO:** create repo for certification registry and link here). ### Tier 2 - Third-party verified conformance [TODO]