Crosswalk with SLSA
david-a-wheeler opened this issue · 4 comments
FYI: Melba did some work to identify potential overlaps.
In the Appendix of our guide, we mapped our requirements to 6 other frameworks/guides, and SLSA was one of them. There was very little overlap, but this mapping was done prior to SLSA achieving 1.0 and might need to be double checked, but at least we have an existing mapping to start from:
AUD-1 | Verify the provenance of your OSS | SLSA: Provenance – Dependencies complete
REB-1 | Rebuild the OSS in a trusted build environment, or validate that it is reproducibly built | SLSA: Build - Reproducible
Following the release of SLSA 1.0, we do not believe there are any overlapping requirements anymore. However, the SLSA: Producing Artifacts - Distribute Provenance requirement is a touch-point with the S2C2F's AUD-1: Verify the provenance of your OSS.
I will update the Appendix to reflect this.
Updated appendix to reflect SLSA v1.0 touchpoint