Skip to content

Commit

Permalink
Address review comments; Prefix requirements with responsible party
Browse files Browse the repository at this point in the history
Signed-off-by: Marcela Melara <[email protected]>
  • Loading branch information
marcelamelara committed Dec 14, 2023
1 parent 5a77a88 commit 1699223
Showing 1 changed file with 23 additions and 27 deletions.
50 changes: 23 additions & 27 deletions docs/spec/v1.1/levels.md
Original file line number Diff line number Diff line change
Expand Up @@ -95,19 +95,19 @@ but is trivial to bypass or forge.
Projects and organizations wanting to easily and quickly gain some benefits of
SLSA---other than tamper protection---without changing their build workflows.

<dt>Software Producer Requirements<dd>
<dt>Requirements<dd>

- Follow a consistent build process so that others can form expectations
about what a "correct" build looks like.
- **Software producer:**

- Distribute provenance to consumers, preferably using a convention
determined by the package ecosystem.
- Follow a consistent build process so that others can form
expectations about what a "correct" build looks like.

<dt>Build Platform Requirements<dd>
- Distribute provenance to consumers, preferably using a convention
determined by the package ecosystem.

- Automatically generate [provenance] describing how the artifact was
built, including: what entity built the package, what build process they
used, and what the top-level input to the build were.
- **Build platform:** Automatically generate [provenance] describing how
the artifact was built, including: what entity built the package, what
build process they used, and what the top-level input to the build were.

<dt>Benefits<dd>

Expand Down Expand Up @@ -149,22 +149,19 @@ Projects and organizations wanting to gain moderate security benefits of SLSA by
switching to a hosted build platform, while waiting for changes to the build
platform itself required by [Build L3].

<dt>Software Producer Requirements<dd>
<dt>Requirements<dd>

All of [Build L1], plus:

- Run builds on a hosted build platform that meets Build L2 requirements.

- Enable downstream verifiers of provenance to validate the authenticity
of the provenance.

<dt>Build Platform Requirements<dd>
- **Software producer:** Run builds on a hosted build platform that meets
Build L2 requirements.

All of [Build L1], plus:
- **Build platform:** Generate and sign[^sign] the provenance itself. This
may be done during the original build, an after-the-fact reproducible
build, or some equivalent platform that ensures the trustworthiness of
the provenance.

- Generate and sign[^sign] the provenance itself. This may be done during
the original build, an after-the-fact reproducible build, or some
equivalent platform that ensures the trustworthiness of the provenance.
- **Consumer:** Validate the authenticity of the provenance.

<dt>Benefits<dd>

Expand Down Expand Up @@ -204,19 +201,18 @@ strong tamper protection.
Most software releases. Build L3 usually requires significant changes to
existing build platforms.

<dt>Software Producer Requirements<dd>
<dt>Requirements<dd>

All of [Build L2], plus:

- Run builds on a hosted build platform that meets Build L3 requirements.
- **Software producer:** Run builds on a hosted build platform that meets
Build L3 requirements.

<dt>Build Platform Requirements<dd>

All of [Build L2], plus:
- **Build platform:** Implement strong controls to:

- Implement strong controls to:
- prevent runs from influencing one another, even within the same
project.

- prevent runs from influencing one another, even within the same project.
- prevent secret material used to sign the provenance from being
accessible to the user-defined build steps.

Expand Down

0 comments on commit 1699223

Please sign in to comment.