Rename `ConfigSource`

[chuangw6]

In v0.42, we introduced a new field Provenance into TaskRun / PipelineRun status to pipe through some data needed for the provenance generation. It's an alpha feature gated by the dedicated feature flag enable-provenance-in-status.

For example, one subfield of it is currently named configSource for recording the source information of the remote task/pipeline definition. But the issue with this naming is that it came from SLSA 0.2 spec. Since SLSA is evolving, we want to change this name to something not specific to SLSA.

[chuangw6]

Based on the discussion, options are as follows and it seems like TektonSource is preferred.

• TektonSource
• Source
• TektonSpecSource
• SpecSource
• TektonRemoteSource

Just want to surface this to broader audience. If there is no strong objections for the name TektonSource, I'll update the #5831 shortly. Otherwise, please feel free to share if anyone has any idea for the naming.

cc @bobcatfish @Yongxuanzhang @dibyom @wlynch @jagathprakash. Thanks!

[wlynch]

If the original concern was this was a name borrowed from SLSA v0.2, and SLSA v1 isn't using the ConfigSource naming anymore, is this still a problem?

If we still want to rename, my preference would be to use RefProvenance or RefSource, since we're trying to describe the provenance of the resolved source of a ref.

• TektonSource and Source - you're using Tekton so the prefix is probably redundant - I'd say these seem equivalent. Any objection to Source being too generic can also probably be applied to TektonSource
• TektonSpecSource and SpecSource - same as above plus we're not trying to describe a spec, we're trying to describe a ref (that will resolve to a spec).
• TektonRemoteSource - I'd drop the Tekton bit, but if the reason we want to move away from ConfigSource naming is because we don't have an Config resource type, then similar logic also applies here - we refer to the process of resolving particular refs as remote resolution, but we don't actually have a Remote resource. 🤷

[chuangw6]

Thanks @wlynch for sharing your thoughts. Great analysis.

I like RefSource!!

(Spec source is indeed confusing in the sense that people might wonder if the spec of SpecSource appearing in a pipelinerun status refers to pipelinerun spec or pipeline spec. )

[dibyom]

RefSource sounds good