search

in-toto / witness

Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.
https://witness.dev
Apache License 2.0
416 stars 60 forks source link

Consider Updates to Attestor Type Documentation #372

Open Strakeln opened 10 months ago

Strakeln commented 10 months ago

There doesn't seem to be a place where the attestor type names are specified (for input with witness run -a). The attestor types have documentation pages found here, but the actual argument provided to the -a option is not easily discovered.

For example, the CommandRun attestor documentation can be found here, but the actual argument provided to -a, command-run, is not easily found. This may be a poor example as there appear to be separate issues with specifying -a command-run.

tannerjones4075 commented 10 months ago

Hello @Strakeln thanks for brining this to our attention. We have a doc file that outlines the witness arguments. Is this what you are referencing?

Strakeln commented 10 months ago

Hey @tannerjones4075 - that is an example of what I'm referring to. Specifically looking at the following option:

-a, --attestations strings Attestations to record ('product' and 'material' are always recorded) (default [environment,git])

The valid strings arguments to provide to this option are not easily found. The help text mentions product, material, environment, and git. I believe that this page lists the available attestors, but not the specific string we should provide to the -a option.

I realize that some of the specific strings are the same as the document name in the page I linked (ex: product, material, jwt, oci, environment, git, maven), but I believe there is at least one example where that is not the case (commandrun, for which I believe the string is actually command-run.

Basically, I'm just looking for a list of valid values to provide to the -a option.