search

slsa-framework / slsa

Supply-chain Levels for Software Artifacts
https://slsa.dev
Other
1.49k stars 214 forks source link

Metadata to include indication of Non-falsifiable provenance (builder) #315

Open lumjjb opened 2 years ago

lumjjb commented 2 years ago

We have been working on non-falsifiable provenance requirement for SLSA 3 for Tekton (TEP doc PR branch).

As part of chains creating the SLSA provenance, we are wondering if we should include a flag that non-falsifiable provenance was enforced as part of the builder - and if so, where it would be included.

We are looking for guidance on where this information should be included, and if it requires any revisions to provenance spec.

cc: @pxp928 @priyawadhwa

lumjjb commented 2 years ago

Had a chat with @MarkLodato @TomHennen @wietse-gmail, and here is a summary of our conversations:

Having this information as part of SLSA artifact provenance wouldn't be as useful as there isn't a way to trust the field as specified by the builder. The use case of administrative convenience (i.e. checking if builds produced by builder have that information encoded) is overshadowed by the risk of misuse in policy by others.

Information on the builder still has to be encoded somehow in order to make decisions. This is mostly done today by encoding the builder ID (with their corresponding keys) and having that be enforced during policy evaluation time.

However, this brings up a question of builder trust and accreditation, which may benefit from input by the larger ecosystem - auditors, certification groups, etc. The mechanism of having non-artifact attestations were brought up (and part as part of intoto/attestation#5) as a point of future discussion.

tl; dr non-falsifiable indication good, but SLSA artifact provenance is not the right place. TODO: explore builder attestation documents.

MarkLodato commented 2 years ago

Thanks for the recap, @lumjjb. I suggest that we leave this issue open with the action item of documenting this somewhere official. This is not the first time this concept has come up, so we should have some sort of official documentation on this recommendation.