3 ms·

So I went to check SLSA Version Controlled: On the maintainer side Verified History: On the maintainer side Retained Indefinitely: Can be both Two Pers

by di4na 4y ago

So I went to check SLSA Version Controlled: On the maintainer side Verified History: On the maintainer side Retained Indefinitely: Can be both Two Person Reviewed: On the maintainer side Scripted Build: On the maintainer side, could be both but not the current model Build Service: Both i suppose Build as code: On the maintainer side Ephemeral env: User side Isolated: Both Parameterless: Both Hermetic: Both but mostly maintainer Reproducible: Maintainer side Available: Could be discussed but maintainer Authenticated: Maintainer Service Generated: Both Non-Falsifiable: both Dependencies complete: Both Security: Maintainer side Access: Not applicable Superusers: Both So SLSA mostly demand work from the maintainers, not the users.

er4hn 4y ago
Thank you for reading through it and summarizing. I disagree with your conclusion however. It's not possible for someone to completely trace upstream dependencies in a SLSA compliant manner. No company can sanely expect that. What can be done is to say "we have some code from outside. How can we attribute it to upstream and make sure it has not been altered?" You can use signatures from the maintainers, version it, even reference a git commit. I don't think that anything additional from maintainers should be required, it's on the company to figure out how best to do so.
- di4na 4y ago
  I understand your point. But that is explicitly not the point the SLSA are making, nor any of the thought leadership on this. The reality of opensource are totally absent in these discussions. Noone say the things you just said. I understand why you think it should be obvious and how it is done, but that is simply not the reality out there.