diff --git a/docs/spec/v1.0/verification_summary.md b/docs/spec/v1.0/verification_summary.md index 6cedb40a9..29f72baaf 100644 --- a/docs/spec/v1.0/verification_summary.md +++ b/docs/spec/v1.0/verification_summary.md @@ -191,15 +191,15 @@ of the other top-level fields, such as `subject`, see [Statement]._ > > Map from [SlsaResult] to the number of the artifact's _transitive_ dependencies > that were verified at the indicated level. Absence of a given level of -> [SlsaResult] MUST be interpreted as reporting _0_ dependencies at that level, -> e.g. an empty `dependencyLevels` object means that the artifact has **no** -> dependency at all (vs. a non-present, i.e. "null", `dependencyLevels` means -> that the verifier does not disclose the dependency stats). +> [SlsaResult] MUST be interpreted as reporting _0_ dependencies at that level. +> A set but empty `dependencyLevels` object means that the artifact has **no** +> dependency at all, while an unset or null `dependencyLevels` means that the +> verifier makes no claims about the artifact's dependencies. > > Users MUST count each dependency only once per SLSA track, at the highest > level verified. For example, if a dependency meets `SLSA_BUILD_LEVEL_2`, > you include it with the count for `SLSA_BUILD_LEVEL_2` but not the count for -> the other `SLSA_BUILD` levels. +> `SLSA_BUILD_LEVEL_1`. `slsaVersion` _string, optional_ @@ -254,15 +254,16 @@ WARNING: This is just for demonstration purposes. -The result of evaluating an artifact (or set of artifacts) against SLSA. -SHOULD contain one value per SLSA track: +The result of evaluating an artifact (or set of artifacts) against SLSA tracks. +SHOULD be one of these values: - SLSA BUILD track: - `SLSA_BUILD_LEVEL_0` - `SLSA_BUILD_LEVEL_1` - `SLSA_BUILD_LEVEL_2` - `SLSA_BUILD_LEVEL_3` -- FAILED (Indicates policy evaluation failed, optional) +- General policy evaluation track: + - `FAILED` Note that each SLSA level implies the levels below it in the same track. For example, `SLSA_BUILD_LEVEL_3` means (`SLSA_BUILD_LEVEL_1` + diff --git a/docs/spec/v1.1/verification_summary.md b/docs/spec/v1.1/verification_summary.md index a03177fcc..24b729b13 100644 --- a/docs/spec/v1.1/verification_summary.md +++ b/docs/spec/v1.1/verification_summary.md @@ -191,15 +191,15 @@ of the other top-level fields, such as `subject`, see [Statement]._ > > Map from [SlsaResult] to the number of the artifact's _transitive_ dependencies > that were verified at the indicated level. Absence of a given level of -> [SlsaResult] MUST be interpreted as reporting _0_ dependencies at that level, -> e.g. an empty `dependencyLevels` object means that the artifact has **no** -> dependency at all (vs. a non-present, i.e. "null", `dependencyLevels` means -> that the verifier does not disclose the dependency stats). +> [SlsaResult] MUST be interpreted as reporting _0_ dependencies at that level. +> A set but empty `dependencyLevels` object means that the artifact has **no** +> dependency at all, while an unset or null `dependencyLevels` means that the +> verifier makes no claims about the artifact's dependencies. > > Users MUST count each dependency only once per SLSA track, at the highest > level verified. For example, if a dependency meets `SLSA_BUILD_LEVEL_2`, > you include it with the count for `SLSA_BUILD_LEVEL_2` but not the count for -> the other `SLSA_BUILD` levels. +> `SLSA_BUILD_LEVEL_1`. `slsaVersion` _string, optional_ @@ -351,8 +351,8 @@ verifiers they add to their roots of trust. -The result of evaluating an artifact (or set of artifacts) against SLSA. -SHOULD contain one value per SLSA track: +The result of evaluating an artifact (or set of artifacts) against SLSA tracks. +SHOULD be one of these values: - SLSA BUILD track: - `SLSA_BUILD_LEVEL_UNEVALUATED` @@ -360,7 +360,8 @@ SHOULD contain one value per SLSA track: - `SLSA_BUILD_LEVEL_1` - `SLSA_BUILD_LEVEL_2` - `SLSA_BUILD_LEVEL_3` -- FAILED (Indicates policy evaluation failed, optional) +- General policy evaluation track: + - `FAILED` Note that each SLSA level implies the levels below it in the same track. For example, `SLSA_BUILD_LEVEL_3` means (`SLSA_BUILD_LEVEL_1` +