Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Clarify (and scope?) "policy" as referenced in provenance format specification (v0.2) #394

Open
joshuagl opened this issue Jun 8, 2022 · 0 comments
Open

Clarify (and scope?) "policy" as referenced in provenance format specification (v0.2) #394

joshuagl opened this issue Jun 8, 2022 · 0 comments
Labels
clarification Clarification of the spec, without changing meaning

Comments

@joshuagl
Copy link
Member

joshuagl commented Jun 8, 2022

The v0.2 provenance format specification states that invocation.environment are usually "not evaluated as part of policy".

Per the discussion in slsa-framework/slsa-github-generator#196 the "original intention of "policy" was to ensure that the package was built from the intended source and build process." - in other words, verify that the produced artifact matches the intended source and build process – the core integrity properties of SLSA.
@joshuagl joshuagl added the clarification Clarification of the spec, without changing meaning label Jun 8, 2022
@joshuagl joshuagl mentioned this issue Jun 8, 2022
Open
@kpk47 kpk47 moved this to 🆕 New in Issue triage May 25, 2023
@kpk47 kpk47 moved this from 🆕 New Issues to 📋 Backlog in Issue triage May 25, 2023
@kpk47 kpk47 moved this from 📋 Backlog to Untriaged in Issue triage Jun 26, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
clarification Clarification of the spec, without changing meaning
Projects
Issue triage
Status: Untriaged
Milestone
No milestone
Development

No branches or pull requests
1 participant
@joshuagl