Promote SLSAv1.0 offering of Chains format to `beta`

chitrangpatel commented 4 months ago

This was discussed at the Chains WG on July 18th. Since SLSAv1.0 was released, Chains provided support for it starting with provenance format slsa/v2alpha2. At this point, it is slsa/v2alpha4 (which includes support for StepActions and StepResults).

We propose stabilizing this to a Beta version: v2beta1 so that there is reduced immediate breaking changes and our users can adopt it more.

Here, I highlight some missing items:

Implement support for Tekton Artifacts. The final PR is under review and we can introduce support for it in Chains right after.
Identify the name of the pipelineTask/pipelineRun/taskRun/Step using the remote resource (Pipeline, Task, StepAction) in the resolved dependencies and byProducts. This will help with completeness.
Capture the origin of a remote StepAction (i.e. uri and digest) in the resolved dependencies: https://github.com/tektoncd/pipeline/pull/8106

chitrangpatel commented 4 months ago

cc @lcarva @renzodavid9

chitrangpatel commented 4 months ago

@renzodavid9 please add any other items here that I may have missed.

renzodavid9 commented 4 months ago

With https://github.com/tektoncd/pipeline/pull/8106 merged we can implement last point from https://github.com/tektoncd/chains/issues/1160#issue-2417114302, I'll take a look an open a PR for it

PuneetPunamiya commented 4 months ago

@chitrangpatel @renzodavid9 I'll work on this part

Identify the name of the pipelineTask/pipelineRun/taskRun/Step using the remote resource (Pipeline, Task, StepAction) in the resolved dependencies and byProducts. This will help with completeness.

tektoncd / chains

Promote SLSAv1.0 offering of Chains format to `beta` #1160