buildConfig
. The model is unchanged.definedInMaterial
and entryPoint
with configSource
.recipe
to invocation
.invocation.type
to top-level buildType
.arguments
to parameters
.buildConfig
, which can be used as an alternative to configSource
to validate the configuration.--
You received this message because you are subscribed to the Google Groups "slsa-discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to slsa-discussi...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/slsa-discussion/CAG1DgwQ55B1qwxauzko75ppjOaHQ0ZEf8R2kstuTJ1sHK%3D0PWg%40mail.gmail.com.
Personally I'm missing the mapping from 0.1 to 0.2. E.g. how should the `definedInMaterial: 0` be replaced with the new structure?
How is the new spec resolving the issue of having one or many materials?
See this issue where we would like to implement the spec to provide some feedbackAlso see the workflow on how the action is currently generating provenance from a GitHub releasehttps://github.com/philips-labs/slsa-provenance-action/blob/main/.github/workflows/ci.yaml#L114-L128What if my build uses multiple invocation types?e.g. make, docker build, goreleaser?What would be the buildtype in such a combined release.e.g. I'm using goreleaser to build my backend including docker images, using some shell script to build my static webpage using nextjs, and then use some shell script to build the docker images for the static webpage. This together is bundled as a GitHub release and pushed to various registries.
--On Wednesday, November 3, 2021 at 9:36:41 PM UTC+1 mliebe...@gmail.com wrote:I used 0.1 and find this a bit easier and more straight forward.On Wednesday, 3 November 2021 at 15:48:48 UTC-4 trishank....@datadoghq.com wrote:On Wed, Nov 3, 2021 at 3:44 PM 'Mark Lodato' via slsa-discussion <slsa-di...@googlegroups.com> wrote:Hi all,We plan to finalize the provenance v0.2 schema on Monday. If you have any feedback on the design, please comment before Monday either on this thread or via GitHub issues. In particular, it would be great to hear from those who have used v0.1 and found it confusing. We hope this new design makes it easier to use.Changes listed here for your convenience:
- 0.2: Refactored to aid clarity and added
buildConfig
. The model is unchanged.
- Replaced
definedInMaterial
andentryPoint
withconfigSource
.- Renamed
recipe
toinvocation
.- Moved
invocation.type
to top-levelbuildType
.- Renamed
arguments
toparameters
.- Added
buildConfig
, which can be used as an alternative toconfigSource
to validate the configuration.You can view a full diff on GitHub.Best regards,Mark--
You received this message because you are subscribed to the Google Groups "slsa-discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to slsa-discussi...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/slsa-discussion/CAG1DgwQ55B1qwxauzko75ppjOaHQ0ZEf8R2kstuTJ1sHK%3D0PWg%40mail.gmail.com.
You received this message because you are subscribed to the Google Groups "slsa-discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to slsa-discussi...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/slsa-discussion/90fa914a-8e9d-4cc7-99cc-0c0cbeefaa1bn%40googlegroups.com.