in-toto / specification

Specification and other related documents.
https://in-toto.io
MIT License
38 stars 25 forks source link

Add _type to step definition #50

Closed sudo-bmitch closed 3 years ago

sudo-bmitch commented 3 years ago

The Step definition is missing the _type field that is included in examples and both the python and go implementations.

Signed-off-by: Brandon Mitchell git@bmitch.net

adityasaky commented 3 years ago

Hi @sudo-bmitch, thanks for the patch. I'm, however, a little confused as the _type field is used to distinguish between layouts and links. The dictionary you've pointed to is mapped, in a layout, to the steps key.

{ "_type" : "layout",
  "expires" : "<EXPIRES>",
  "readme": "<README>",
  "keys" : {
     "<KEYID>" : "<PUBKEY_OBJECT>"
  },
  "steps" : [
    "<STEP>",
    "..."
  ],
  "inspect" : [
    "<INSPECTION>",
    "..."
  ]
}

Each <STEP> is a dictionary that has the name, expected materials, expected products etc fields.

sudo-bmitch commented 3 years ago

@adityasaky I'm incline to agree, which is why I was surprised to see this field added as a required entry in both the python and golang implementations: https://github.com/in-toto/in-toto/blob/develop/in_toto/models/layout.py#L615 https://github.com/in-toto/in-toto-golang/blob/master/in_toto/model.go#L505

It's also in the various examples, including: https://github.com/in-toto/docs/blob/559aa8960d767508bf6f4433e2b2f9568403c079/examples/seattle/root.layout#L60 https://github.com/in-toto/docs/blob/559aa8960d767508bf6f4433e2b2f9568403c079/examples/debian/root.layout#L26

So I felt it was easier and less disruptive to update the documentation to match the implementation.

adityasaky commented 3 years ago

Thanks for the links! I did a cursory check of the examples, but I was looking at those in the spec rather than in the directory, my bad. Looking at the python / go implementations, this does ring a bell now...

SantiagoTorres commented 3 years ago

Hmm! Interestingly, this will become relevant as ITE-6 moves forward... This is something we had added earlier in anticipation for that moment, but it appears we never fully documented that. Thanks!