New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add SLSA conformance to requirements page #572

Merged

kpk47 merged 8 commits into slsa-framework:main from kpk47:main

Jan 30, 2023

Contributor

kpk47 commented Jan 18, 2023

Signed-off-by: kpk47 [email protected]


          Add SLSA conformance to requirements page

5dba6e8

slsa-framework#515

Signed-off-by: kpk47 <[email protected]>

kpk47 requested review from MarkLodato, mlieberman85 and joshuagl as code owners

January 18, 2023 22:52

netlify bot commented Jan 18, 2023 •

edited

Loading

✅ Deploy Preview for slsa ready!

Name	Link
🔨 Latest commit	`e2b8123`
🔍 Latest deploy log	https://app.netlify.com/sites/slsa/deploys/63d846e532985b0008fd7924
😎 Deploy Preview	https://deploy-preview-572--slsa.netlify.app/spec/v1.0/requirements
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site settings.


          lint

de0429e

Signed-off-by: kpk47 <[email protected]>

laurentsimon reviewed

View reviewed changes

docs/spec/v1.0/requirements.md Outdated Show resolved Hide resolved

lehors reviewed

View reviewed changes

docs/spec/v1.0/requirements.md Outdated Show resolved Hide resolved

SecKatie suggested changes

View reviewed changes

Contributor

SecKatie left a comment

I'm thrilled with the progress we've made so far. There are a few areas we can refine to make things even better.

Thanks @kpk47!

docs/spec/v1.0/requirements.md Outdated Show resolved Hide resolved

docs/spec/v1.0/requirements.md Outdated Show resolved Hide resolved

kpk47 and others added 2 commits

January 19, 2023 08:47


          Update docs/spec/v1.0/requirements.md

c1a042c

Co-authored-by: Arnaud J Le Hors <[email protected]>
Signed-off-by: kpk47 <[email protected]>


          Update docs/spec/v1.0/requirements.md

c82e769

Co-authored-by: Joshua Mulliken <[email protected]>
Signed-off-by: kpk47 <[email protected]>

SecKatie approved these changes

View reviewed changes


          review comments & added requirement that attestation include SLSA levels

3da1146

Signed-off-by: kpk47 <[email protected]>

MarkLodato reviewed

View reviewed changes

docs/spec/v1.0/requirements.md Outdated Show resolved Hide resolved

docs/spec/v1.0/requirements.md Show resolved Hide resolved

docs/spec/v1.0/requirements.md Outdated Show resolved Hide resolved


          review comments

bab1c69

Signed-off-by: kpk47 <[email protected]>

MarkLodato approved these changes

View reviewed changes

Member

MarkLodato left a comment

I'd like to hear @lehors's opinion as well.

docs/spec/v1.0/requirements.md Outdated Show resolved Hide resolved

docs/spec/v1.0/requirements.md Outdated Show resolved Hide resolved

lehors reviewed

View reviewed changes

Member

lehors left a comment

I must admit that I don't see much value in the AUDITOR section. It merely contains a MAY and a couple of SHOULDs that don't buy us much.

I would much prefer that we scrap this off and instead add that consumers MUST ensure that the build systems they depend on are conformant and that to do so they can either do their own audit leveraging the prompts in the verifying systems or leverage the certification program which lists conformant systems.

We can leave it to the certification program to get into the details of what certifiers are required to do.

docs/spec/v1.0/requirements.md Outdated Show resolved Hide resolved

SecKatie mentioned this pull request

SLSA Compliance Program #515

Open

6 tasks

kpk47 and others added 2 commits

January 30, 2023 14:36


          Update docs/spec/v1.0/requirements.md

83f92f7

Co-authored-by: Mark Lodato <[email protected]>
Signed-off-by: kpk47 <[email protected]>


          line wrap

e2b8123

Signed-off-by: kpk47 <[email protected]>

kpk47 merged commit cf646c3 into slsa-framework:main

Member

lehors commented Jan 31, 2023

@kpk47 I think it was premature to merge this. I said that I thought the AUDITOR section should be deleted and @MarkLodato agreed.

Contributor Author

kpk47 commented Jan 31, 2023

I'm so sorry. I'm still not used to tracking code reviews in GitHub and thought that I'd addressed all the open comments. I'll send another PR.

chtiangg pushed a commit to chtiangg/slsa that referenced this pull request


          Add SLSA conformance to requirements page (slsa-framework#572)

b780838

* Add SLSA conformance to requirements page

slsa-framework#515

Signed-off-by: kpk47 <[email protected]>

* lint

Signed-off-by: kpk47 <[email protected]>

* Update docs/spec/v1.0/requirements.md

Co-authored-by: Arnaud J Le Hors <[email protected]>
Signed-off-by: kpk47 <[email protected]>

* Update docs/spec/v1.0/requirements.md

Co-authored-by: Joshua Mulliken <[email protected]>
Signed-off-by: kpk47 <[email protected]>

* review comments & added requirement that attestation include SLSA levels

Signed-off-by: kpk47 <[email protected]>

* review comments

Signed-off-by: kpk47 <[email protected]>

* Update docs/spec/v1.0/requirements.md

Co-authored-by: Mark Lodato <[email protected]>
Signed-off-by: kpk47 <[email protected]>

* line wrap

Signed-off-by: kpk47 <[email protected]>

---------

Signed-off-by: kpk47 <[email protected]>
Signed-off-by: kpk47 <[email protected]>
Co-authored-by: Arnaud J Le Hors <[email protected]>
Co-authored-by: Joshua Mulliken <[email protected]>
Co-authored-by: Mark Lodato <[email protected]>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

lehors lehors left review comments

laurentsimon laurentsimon left review comments

MarkLodato MarkLodato approved these changes

SecKatie SecKatie approved these changes

mlieberman85 Awaiting requested review from mlieberman85

joshuagl Awaiting requested review from joshuagl