search

slsa-framework / slsa

Supply-chain Levels for Software Artifacts
https://slsa.dev
Other
1.53k stars 221 forks source link

Define where source attestations are stored #1129

Open TomHennen opened 1 week ago

TomHennen commented 1 week ago

We should provide guidance on where source attestations are stored.

We may not want to be too prescriptive but should provide an allowance for how a source control system (#1128) should do so.

Note that summary and 'full' attestations may be stored in different places.

marcelamelara commented 4 days ago

I think this is a general question for SLSA. @paveliak and I were having this exact discussion about the build environment attestations today as well. We also don't want to be too prescriptive, but provide some practical recommendations.

TomHennen commented 1 day ago

Perhaps we should require the Source Control System (or Build system in the case of the build environment attestations) to document where they're stored and then provide examples in the sample profiles (#1142)?

For git we might suggest "store in the VCS like so", for other systems maybe we suggest a "content addressable storage system by /".