tektoncd / chains

Supply Chain Security in Tekton Pipelines
Apache License 2.0
247 stars 132 forks source link

Limit client libraries for external usage #1044

Open aaron-prindle opened 9 months ago

aaron-prindle commented 9 months ago

This issue tracks the work required to limit tektoncd/chains usage as a client library. Currently some methods/structs are exposed to users that we don't want to be public (eg: don't want them to depend-on/use). Work required is likely a refactor to make some currently public methods, interfaces, structs, etc. private

aaron-prindle commented 8 months ago

Analysis on tektoncd/chains usage as a client library externally. The below methods are those that are relied on for client library external usage to be considered/hopefully-kept-available when limiting client libraries:

"github.com/tektoncd/chains/pkg/chains/formats/formats”

"github.com/tektoncd/chains/pkg/chains/objects/objects"

"github.com/tektoncd/chains/pkg/config/config"

"github.com/tektoncd/chains/pkg/chains/formats/slsa/extract/extract"

"github.com/tektoncd/chains/pkg/chains/formats/slsa/v2alpha3/v2alpha3"