Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for ITE-6 Attestations #562

Open
adityasaky opened this issue Mar 17, 2023 · 7 comments
Open

Add support for ITE-6 Attestations #562

adityasaky opened this issue Mar 17, 2023 · 7 comments

Comments

@adityasaky
Copy link
Member

Please fill in the fields below to submit an issue or feature request. The
more information that is provided, the better.

Description of issue or feature request:

in-toto-python does not currently support generating ITE-6 attestations. The task can be broken down into the following steps:

  1. Generating in-toto Statements. See: https://github.com/in-toto/attestation/blob/main/spec/v1.0-draft/statement.md for more information.
  2. Adding support for specific predicates such as SLSA Provenance and one or more SBOM specs.

The generated metadata can leverage the newly added support for DSSE (#503).

Related: #464, #465, #466

Current behavior:

in-toto-python has no support for generating ITE-6 attestations.

Expected behavior:

in-toto-python can generate ITE-6 attestations with support for some predicate types.

@chasen-bettinger
Copy link
Contributor

@adityasaky Is this ticket ok to pick up?

@adityasaky
Copy link
Member Author

Hi @chasen-bettinger! We've currently listed it for GSoC. Do you plan to apply through GSoC or pick it up directly? (Either is fine)

@chasen-bettinger
Copy link
Contributor

@adityasaky I presume GSoC is 'Google Summer of Code'? I don't really know much about that program so probably picking it up directly.

@adityasaky
Copy link
Member Author

Gotcha! Feel free to jump on the CNCF slack (#in-toto, #in-toto-python) if you have any questions.

chasen-bettinger added a commit to chasen-bettinger/in-toto that referenced this issue Mar 25, 2023
- Added the Statement model
- Incorporated the Statement model into the Envelope.
- Skipped a test because I'm awaiting feedback on whether this is
the right direction to take this issue (in-toto#562). The test is built
on the previously-used 'link' model as the payload.
chasen-bettinger added a commit to chasen-bettinger/in-toto that referenced this issue Mar 25, 2023
- Added the Statement model
- Incorporated the Statement model into the Envelope.
- Skipped a test because I'm awaiting feedback on whether this is
the right direction to take this issue (in-toto#562). The test is built
on the previously-used 'link' model as the payload.

Signed-off-by: Chasen Bettinger <bettingerchasen@gmail.com>
@PradyumnaKrishna
Copy link
Contributor

in-toto doesn't have any methods to generate Provenance predicates, or other predicate types. Does generating such metadata with in-toto and verifying them comes in this project scope?

Also, FYI I have submitted my first draft of proposal on summer of code portal. Please provide me a review.

chasen-bettinger added a commit to chasen-bettinger/in-toto that referenced this issue May 29, 2023
- Added the Statement model
- Incorporated the Statement model into the Envelope.
- Skipped a test because I'm awaiting feedback on whether this is
the right direction to take this issue (in-toto#562). The test is built
on the previously-used 'link' model as the payload.

Signed-off-by: Chasen Bettinger <bettingerchasen@gmail.com>
chasen-bettinger added a commit to chasen-bettinger/in-toto that referenced this issue Aug 17, 2023
- Added the Statement model
- Incorporated the Statement model into the Envelope.
- Skipped a test because I'm awaiting feedback on whether this is
the right direction to take this issue (in-toto#562). The test is built
on the previously-used 'link' model as the payload.

Signed-off-by: Chasen Bettinger <bettingerchasen@gmail.com>
chasen-bettinger added a commit to chasen-bettinger/in-toto that referenced this issue Aug 17, 2023
- Added the Statement model
- Incorporated the Statement model into the Envelope.
- Skipped a test because I'm awaiting feedback on whether this is
the right direction to take this issue (in-toto#562). The test is built
on the previously-used 'link' model as the payload.

Signed-off-by: Chasen Bettinger <bettingerchasen@gmail.com>
chasen-bettinger added a commit to chasen-bettinger/in-toto that referenced this issue Aug 17, 2023
- Added the Statement model
- Incorporated the Statement model into the Envelope.
- Skipped a test because I'm awaiting feedback on whether this is
the right direction to take this issue (in-toto#562). The test is built
on the previously-used 'link' model as the payload.

Signed-off-by: Chasen Bettinger <bettingerchasen@gmail.com>
chasen-bettinger added a commit to chasen-bettinger/in-toto that referenced this issue Aug 17, 2023
- Added the Statement model
- Incorporated the Statement model into the Envelope.
- Skipped a test because I'm awaiting feedback on whether this is
the right direction to take this issue (in-toto#562). The test is built
on the previously-used 'link' model as the payload.

Signed-off-by: Chasen Bettinger <bettingerchasen@gmail.com>
@mmcniece
Copy link

👋 hey @chasen-bettinger & @adityasaky -- I'm looking to use the in-toto lib to generate provenance attestations. Is there a place I can jump in to help get this across the line and merged?

@adityasaky
Copy link
Member Author

Have you taken a look at #570? Also cc @marcelamelara

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants