search

slsa-framework / slsa

Supply-chain Levels for Software Artifacts
https://slsa.dev
Other
1.52k stars 220 forks source link

What does "exist in the present context" mean? #1138

Open TomHennen opened 17 hours ago

TomHennen commented 17 hours ago

What does "exist in the present context" mean?

_Originally posted by @marcelamelara in https://github.com/slsa-framework/slsa/pull/1094#discussion_r1722360178_

@zachariahcox

for git repos, a revision is just a tree id in a big database. Preventing trees from existing can only happen at push receive time and causes a ton of developer friction.

Especially when teams rely on pull requests, the "reachable from this ref" security boundary is the most practical. It models whether a commit / tree id is included in a specific subset. That subset has certain properties. I think that's what we're saying by context here, but it might need some additional definition here!

zachariahcox commented 7 hours ago

I think we're proposing a new definition:

"Revision context": a named subset of all revisions in the database. Inclusion in the subset can be governed by policy.