Skip to content

Commit

Permalink
address some comments by arewm
Browse files Browse the repository at this point in the history
Signed-off-by: Mark Lodato <lodato@google.com>
  • Loading branch information
MarkLodato committed Oct 27, 2023
1 parent 7b121c5 commit d3f5508
Showing 1 changed file with 4 additions and 3 deletions.
7 changes: 4 additions & 3 deletions docs/spec/v1.1/principles.md
Original file line number Diff line number Diff line change
Expand Up @@ -26,16 +26,17 @@ Guidelines:
"Provenance exists".

- **Balance level granularity.** Too many levels makes SLSA hard to understand
and remember, while too few makes each level hard to achieve. Try to bundle
and remember; too few makes each level hard to achieve. Try to bundle
requirements into levels such that an implementer is likely implement all at
the same time.

- **Use tracks sparingly.** Additional tracks add extra complexity to SLSA, so
a new track should be seen as a last resort. Each track should have a clear,
distinct purpose with a crisply defined objective, such as trustworthy
provenance for the [Build track](levels#build-track). As a rule of thumb, a
new track may be warranted the threats it addresses are unrelated to those
of other tracks. Try to avoid tracks that sound confusingly similar.
new track may be warranted if the threats it addresses are unrelated to
those of other tracks. Try to avoid tracks that sound confusingly similar in
either name or objective.

## Trust platforms, verify artifacts

Expand Down

0 comments on commit d3f5508

Please sign in to comment.