Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Promote SLSAv1.0 offering of Chains format to beta #1160

Open
chitrangpatel opened this issue Jul 18, 2024 · 4 comments
Open

Promote SLSAv1.0 offering of Chains format to beta #1160

chitrangpatel opened this issue Jul 18, 2024 · 4 comments

Comments

@chitrangpatel
Copy link
Contributor

chitrangpatel commented Jul 18, 2024

This was discussed at the Chains WG on July 18th.
Since SLSAv1.0 was released, Chains provided support for it starting with provenance format slsa/v2alpha2. At this point, it is slsa/v2alpha4 (which includes support for StepActions and StepResults).

We propose stabilizing this to a Beta version: v2beta1 so that there is reduced immediate breaking changes and our users can adopt it more.

Here, I highlight some missing items:

  • Implement support for Tekton Artifacts. The final PR is under review and we can introduce support for it in Chains right after.
  • Identify the name of the pipelineTask/pipelineRun/taskRun/Step using the remote resource (Pipeline, Task, StepAction) in the resolved dependencies and byProducts. This will help with completeness.
  • Capture the origin of a remote StepAction (i.e. uri and digest) in the resolved dependencies: Capture Remote StepAction Location in TaskRun Status pipeline#8106
@chitrangpatel
Copy link
Contributor Author

cc @lcarva @renzodavid9

@chitrangpatel
Copy link
Contributor Author

@renzodavid9 please add any other items here that I may have missed.

@renzodavid9
Copy link
Contributor

With tektoncd/pipeline#8106 merged we can implement last point from #1160 (comment), I'll take a look an open a PR for it

@PuneetPunamiya
Copy link
Member

@chitrangpatel @renzodavid9
I'll work on this part

  • Identify the name of the pipelineTask/pipelineRun/taskRun/Step using the remote resource (Pipeline, Task, StepAction) in the resolved dependencies and byProducts. This will help with completeness.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants