content: source-track: rename SCP to SCS, replace open issues section with links to project and label queries #1166

zachariahcox · 2024-09-30T19:00:51Z

This change is in response to the 9.30 slsa specification meeting on this topic.

A SCS is the full suite of services and ideas relied upon by the organization to create source revisions.

VCS stuff should mostly fall out of the discussion

Repositories can be used as the concept used when we need to talk about authN and authZ w.r.t. authentic contributions.

…ke that work

netlify · 2024-09-30T19:01:11Z

✅ Deploy Preview for slsa ready!

Name	Link
🔨 Latest commit	`8629a9b`
🔍 Latest deploy log	https://app.netlify.com/sites/slsa/deploys/66fbf4bad49d8d000852706e
😎 Deploy Preview	https://deploy-preview-1166--slsa.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

zachariahcox · 2024-09-30T19:46:43Z

docs/spec/draft/source-requirements.md

@@ -121,18 +110,18 @@ The source MUST have a location where the "official" revisions are stored and ma
 #### Revisions are immutable and uniquely identifiable

 This requirement ensures that a consumer can determine that the source revision they have is the same as a canonical revision.
-The combination of SCP and VCS MUST provide a deterministic way to identify a particular revision.


@marcelamelara I definitely like having a single term for "the combination of". I'm not sure it really helps bring clarity to what we mean by it, but "the system must provide X" is at least less clunky to read.

zachariahcox · 2024-09-30T19:47:39Z

docs/spec/draft/source-requirements.md

-The SCP MUST declare which forms of identity it considers to be trustworthy for this purpose.
-For cloud-based SCPs, this will typically be the identity used to push to a git server.
+The SCS MUST declare which forms of identity it considers to be trustworthy for this purpose.
+For cloud-based SCSs, this will typically be the identity used to push to a repository.


also removed the casual use of the word "git" here

zachariahcox · 2024-09-30T19:49:02Z

docs/spec/draft/verifying-source.md

@@ -168,7 +168,7 @@ It is not sufficient to indicate that a file changed without showing the content

 Require a squash merge strategy for the protected branch.

-To guarantee that only commits representing reviewed diffs are cloned, the SCP MUST rebase (or "squash") the reviewed diff into a single new commit (the "squashed" commit) that has only a single parent (the revision previously pointed-to by the protected branch).
+To guarantee that only commits representing reviewed diffs are cloned, the SCS MUST rebase (or "squash") the reviewed diff into a single new commit (the "squashed" commit) that has only a single parent (the revision previously pointed-to by the protected branch).


edited this use case for completeness, but this one is "the tool that generates commits on behalf of the code review tool".
For github (and probably other all-in-one systems, these are the same tool.

This PR proposes to change the status of v1.1 to Candidate Release in preparation for final publication. I ought to point out that there is a bunch of VSA related issues that had been targeted for this release and that have not been addressed. See Issue slsa-framework#900. However, until someone works on any of these issues there is no hope of making progress and waiting for these to close will delay getting 1.1 out indefinitely. Although not ideal I therefore propose to defer these and publish what we have. Signed-off-by: Arnaud J Le Hors <lehors@us.ibm.com>

…1109) Blogpost that looks at dependency confusion and typosquatting attacks from defender's perspective and defines "managed ingestion" as an important capability for supply chain risk management. --------- Signed-off-by: Meder Kydyraliev <1212257+meder@users.noreply.github.com> Co-authored-by: Joshua Lock <joshuagloe@gmail.com> Co-authored-by: Marcela Melara <marcela.melara@intel.com>

I noticed that the jekyll build was producing an error because the `description` variable in the front matter of the `verifying-source.md` file contained multiple lines. This fixes the format so that there is no longer any error and as a consequence the page title is now displayed correctly. However, I must admit that although every page contains a description I cannot find whether it is actually used anywhere... Signed-off-by: Arnaud J Le Hors <lehors@us.ibm.com>

1. Only check for duplicate headings in siblings. It's useful to have allow duplicated headings that aren't in siblings to let docs have parallel construction across the entire doc. 2. Remove absolute references to slsa.dev Signed-off-by: Tom Hennen <tomhennen@google.com>

slsa-framework#1123) This patch focuses on merely editorial changes such as moving sections around and changing 'out of scope' to 'not currently addressed'. There are a lot more TODOs to go through but that's a first step... Signed-off-by: Arnaud J Le Hors <lehors@us.ibm.com>

…e track level of revisions (slsa-framework#1094) fixes slsa-framework#1071 fixes slsa-framework#1042 refs slsa-framework#241 This PR modifies _draft_ content of the SLSA spec. See [discussions here](https://docs.google.com/document/d/13Xt8mA_2b00McGX2vkyhu4GQdFAqtXPu7YXE8ZA6ISE/edit?resourcekey=0-EqfHF79tUWAKp4PzsE3z1A&tab=t.0#heading=h.fhg4lsemfpz2) [and here](https://docs.google.com/document/d/1PwhekVB1iDpcgCQRNVN_aesoVdOiTruoebCs896aGxw/edit#bookmark=id.oqoqjt4urxm). Google document requires [slsa-discussion@googlegroups.com](mailto:slsa-discussion@googlegroups.com) membership. Define how downstream users can verify the SLSA source track level of revisions by using a [VSAs](http://slsa.dev/verification_summary) produced by the Source Control Platform (SCP). To use these VSAs users do not need to know the specifics of how any given SCP or Version Control System (VCS) meets the SLSA source requirements (which may vary greatly from implementation to implementation). Instead it is left to the SCP or another trusted 'authority' to make that determination for downstream users. The question of _how_ the authority ensures those claims to be true is left undefined in this change. Future updates can include guidance for how to verify source level when combined with [build provenance](https://slsa.dev/provenance). 1. A user wants to verify slsa-framework@9a04d1e is SLSA source level 3. 2. The user 'trusts' GitHub as the authority for source revisions managed by GitHub. 3. The user requests a VSA for slsa-framework@9a04d1e from a TBD API 4. The user verifies the VSA following [the standard instructions](https://slsa.dev/spec/draft/verification_summary#how-to-verify) or using [standard tooling](https://github.com/slsa-framework/slsa-verifier?tab=readme-ov-file#verification-summary-attestations-vsa) and looking for `SLSA_SOURCE_LEVEL_2` in the `verifiedLevels` field. --------- Signed-off-by: Tom Hennen <tomhennen@google.com> Signed-off-by: Tom Hennen <TomHennen@users.noreply.github.com> Co-authored-by: Zachariah Cox <zachariahcox@github.com> Co-authored-by: Aditya Sirish <8928778+adityasaky@users.noreply.github.com> Co-authored-by: Marcela Melara <marcela.melara@intel.com>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-node](https://redirect.github.com/actions/setup-node) | action | patch | `v4.0.3` -> `v4.0.4` | --- ### Release Notes <details> <summary>actions/setup-node (actions/setup-node)</summary> ### [`v4.0.4`](https://redirect.github.com/actions/setup-node/compare/v4.0.3...v4.0.4) [Compare Source](https://redirect.github.com/actions/setup-node/compare/v4.0.3...v4.0.4) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/slsa-framework/slsa).  Signed-off-by: Mend Renovate <bot@renovateapp.com>

Suggest PR authors assign specific reviewers and ping the Slack channel if they want. The goal is to make it more clear who is expected to take the next action on PRs vs the current situation where the maintainers may think someone else will take a look or that they may have missed the initial PR request. fixes slsa-framework#1149 --------- Signed-off-by: Tom Hennen <tomhennen@google.com> Signed-off-by: Tom Hennen <TomHennen@users.noreply.github.com> Co-authored-by: Marcela Melara <marcela.melara@intel.com>

…k#1157) Closes slsa-framework#1155. Signed-off-by: Arnaud J Le Hors <lehors@us.ibm.com>

…with project board links. (#1171) fixes: #1128 (cleaned up version of #1166) This change is in response to the 9.30 slsa specification meeting on this topic. A SCS is the full suite of services and ideas relied upon by the organization to create source revisions. VCS stuff should mostly fall out of the discussion Repositories can be used as the concept used when we need to talk about authN and authZ w.r.t. authentic contributions.

delete open issues, rename SCP to SCS, adjust copy where needed to ma…

8a9b402

…ke that work

zachariahcox requested review from TomHennen, marcelamelara and trishankatdatadog September 30, 2024 19:00

zachariahcox commented Sep 30, 2024

View reviewed changes

zachariahcox changed the title ~~rename SCP to SCS, replace open issues section with links to project and label queries~~ content: source-track: rename SCP to SCS, replace open issues section with links to project and label queries Oct 1, 2024

renovate-bot and others added 13 commits October 1, 2024 09:08

editorial: Update statement about compliance with SSDF (slsa-framewor…

e1b9c50

…k#1157) Closes slsa-framework#1155. Signed-off-by: Arnaud J Le Hors <lehors@us.ibm.com>

catch a few more places.

8629a9b

zachariahcox closed this Oct 1, 2024

zachariahcox mentioned this pull request Oct 1, 2024

content: draft: source-track: rename SCP to SCS, replace issue links with project board links. #1171

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

content: source-track: rename SCP to SCS, replace open issues section with links to project and label queries #1166

content: source-track: rename SCP to SCS, replace open issues section with links to project and label queries #1166

zachariahcox commented Sep 30, 2024

netlify bot commented Sep 30, 2024 •

edited

Loading

zachariahcox Sep 30, 2024

zachariahcox Sep 30, 2024

zachariahcox Sep 30, 2024

content: source-track: rename SCP to SCS, replace open issues section with links to project and label queries #1166

content: source-track: rename SCP to SCS, replace open issues section with links to project and label queries #1166

Conversation

zachariahcox commented Sep 30, 2024

netlify bot commented Sep 30, 2024 • edited Loading

✅ Deploy Preview for slsa ready!

zachariahcox Sep 30, 2024

Choose a reason for hiding this comment

zachariahcox Sep 30, 2024

Choose a reason for hiding this comment

zachariahcox Sep 30, 2024

Choose a reason for hiding this comment

netlify bot commented Sep 30, 2024 •

edited

Loading