MarkLodato
commented
1 year ago It's unclear whether the field is forgeable or not, even at level 3.
The intent was for the builder.id to indicate this. Also, a possible future "SLSA Build L4" might have requirements about completeness and accuracy of resolvedDependencies.
"REQUIRED: at least one of uri or digest" — What is the reasoning behind this decision? [...] should this field guarantee immutability, ie the Digest be a
MUSTfield?
If you're asking why we allow digest to not be set, it's because in some cases it cannot be computed but it's still valuable to record a dependency. Examples:
- Fetching from a version control system that does not have convenient digests, e.g. Perforce/Piper. Here, the
uriis an immutable reference instead, assuming you trust the version control system (which we have no other choice but to do). - Specifying the VM image that the worker run on. GitHub Actions is an example - we can know which specific VM image GitHub used, but the digest for the VM image is unavailable. Again, the
uriis an immutable reference, assuming you trust the VM compute infrastructure (which we have no other choice but to do).
di
laurentsimon
There is clarification that may be useful w.r.t ResolvedDependencies. IIUC, the fields lists dependencies of the build, not the builder.
Question 1
It's unclear whether the field is forgeable or not, even at level 3. For example, we say
For example, if the build script fetches and executes “example.com/foo.sh”, which in turn fetches “example.com/bar.tar.gz”, then both “foo.sh” and “bar.tar.gz” SHOULD be listed here.Which component of the system populates these entries? The untrusted build process or the trusted build service? Does it depend on SLSA levels? Does it depend on buildType?Example, in GitHub examples, we say
SHOULD contain an entry identifying the resolved git commit ID+The dependency’s uri MUST be .... Here it's assumed to be trusted because it's part of the expectations for a consumer to verify.It would help to clarify the reasoning here. If it's up to the buildType to define these, maybe we should also allow for namespaces within dependencies. Otherwise I will become harder to identify what is what in the future?
Question 2
The specs say that artifacts listed in resolvedDependencies:
REQUIRED: at least one of uri or digesthttps://slsa.dev/provenance/v1-rc1#artifactreference. What is the reasoning behind this decision? Since thepurpose of resolvedDependencies is to facilitate recursive analysis of the software supply chain. Where practical, it is valuable to record the URI and digest of artifacts that, if compromised, should this field guarantee immutability, ie the Digest be aMUSTfield?Many package registries don't guarantee immutability, for example. A purl does not guarantee immutability either, iiuc.