[feature][tracking] - SLSA 1.0 support - Githubissues

slsa-framework / slsa-github-generator

Language-agnostic SLSA provenance generation for Github Actions

Apache License 2.0

433 stars 128 forks source link

[feature][tracking] - SLSA 1.0 support #1734

Open mlieberman85 opened 1 year ago

mlieberman85 commented 1 year ago

This is a tracking issue for SLSA 1.0 support. Feel free to edit this ticket with issues related to supporting SLSA 1.0 requirements/spec.

laurentsimon commented 1 year ago

Thanks @mlieberman85 . A few additional things for visibility:

[ ] BYOB framework https://github.com/slsa-framework/slsa-github-generator/milestone/11
[ ] npm builder https://github.com/slsa-framework/slsa-github-generator/milestone/8. Will be hosted here.
[ ] Maven builder https://github.com/slsa-framework/slsa-github-generator/milestone/14. PoC at https://github.com/AdamKorcz/java-slsa-generator/blob/main/builder/action.yml . Will be hosted here.
[ ] Gradle builder https://github.com/slsa-framework/slsa-github-generator/milestone/15. PoC at https://github.com/AdamKorcz/java-slsa-generator/blob/main/gradle-builder/action.yml. Will be hosted here.
[ ] Anchore SBOM builder.PoC in https://github.com/laurentsimon/sbom-action/tree/feat/slsa-trw. Eventually hosted on anchore's official sbom-action repo
[ ] Bazel builder https://github.com/slsa-framework/slsa-github-generator/milestone/16

ianlewis commented 1 year ago

We did have an existing milestone and tracking issues for SLSA v1.0. https://github.com/slsa-framework/slsa-github-generator/milestone/10

ramonpetgrave64 commented 3 months ago

Also for the npm builder. https://github.com/slsa-framework/slsa-github-generator/issues/2499