Add SLSA3

[plastikfan]

See: General availability of SLSA3 Generic Generator for GitHub Actions

May also need to look into SLSA Go releaser

Start here

This issue depends on the (automated release process to be defined (go-releaser), see #42

[plastikfan]

An example: ko-build

[plastikfan]

AT = Attestation

---

Getting started with SLSA

Reaching SLSA Level 1:

• Automate builds
• Produce provenance data

Even though an automated build process has already been defined with github actions, this still isn't enough as it does not include an automated release process, which we need to implement with goreleaser, (Issue 42)

---

Provenance

Provenance, need understanding of:

• Software attestations
• in-toto attestation framework

---

Attestation

Essentially this is code signing (I wonder if this is only applicable to binaries and not libraries, as in the case of the libary, we don't create a binary, the client does as part of their build process). However, when we tag a release, there is a zipped version of the repo (like a snapshot), perhaps we can sign this.

An AT is more than just a signature. It backs up the signature to describe HOW we created the signature. Eg an AT may include how an artefact was created, ie what build command was used to create it.

Recommended Suite:

The AT model -

• envelope: DSSE (deal simple envelpe signing) THIS IS FOR DIGITAL SIGNATURES (improvement on JWT) for Go, we can use: https://github.com/secure-systems-lab/go-securesystemslib/tree/main/dsse
• statement : is implmented by in-toto AT
• predicate : provenance (one of a few options, SPDX, ...) but you can create a new one if none of the existing ones does not fit

---

Provenance

Describes HOW an artefact was produced.

The Provenance model -

System Inputs (evaluated to create Build Config). (For schema, See: provenance/v0.2)

• environment
• config source
• parameters

External Inputs

• materials (source code I think)

Executed with Build Config and Materials to produce Subject

[plastikfan]

this is not required for a library