Open laurentsimon opened 1 year ago
v0.2 provenance does not have a stable builder ID, so we may defer implementation to v1.0
They are still using slsa v0.2, and that older definition of BuilderID.
I think for gitlab the BuilderID should also be the ref to Gitlab's own equivalent of a GithubWorkflow definition yaml file. And we would need to upgrade the npmcli attestation-generating code to start using v1, like @laurentsimon suggests.
GitLab has some support in https://github.com/npm/cli/pull/6375
https://gist.github.com/wlynch/42e89527d51bc72a61279f0c7f3be1cd