Add Dependency Ingestion Provenance predicate (v1) - #1
Open
mlieberman85 wants to merge 1 commit into
Open
Conversation
Adds the first predicate schema in this repo: the SLSA Dependency Ingestion Provenance predicate defined by the SLSA Dependency Track. - New file: dependency/v1/dependency.proto — DependencyIngestionProvenance message plus supporting messages (Ingestor, IngestionPlatform, UpstreamRef, IngestionEvent, ResolvedFromRef, Scan/Scanner, IntegrityVerdict, PublisherSignatureVerdict, PolicyEvaluation/Policy, UpstreamAttestationRef, SigningIsolation, IngestionIsolation). - README.md: documents the layout convention <predicate>/<version>/<predicate>.proto, package/go_package/java_package naming conventions, and notes that Build/VSA/Source predicate schemas currently live in slsa-framework/slsa and are expected to migrate here over time. The proto tracks the schema at https://github.com/slsa-framework/slsa/blob/main/spec/dependency-provenance.md and includes a keep-in-sync header comment pointing back to the spec. Enumerable values (scan types, isolation methods, verdict strings) are encoded as string fields rather than enums so implementer-defined values remain extensible without proto changes. Level-based requirements (REQUIRED at L2+, etc.) are documented in the spec, not in the schema; validation of all fields is left to the users of this proto. Signed-off-by: Michael Lieberman <mlieberman85@gmail.com>
puerco
reviewed
Sep 5, 2026
Member
There was a problem hiding this comment.
Small technical nits to make this work with the repo automation.
First, rename the .proto file to proto/dependency/v1/predicate.proto. When we run make generate, buf will pick it up and write the go module in the directory where the proto is now, but this lets us separate the protos and the generated code. I would also suggest dropping the README for now :)
And these two small changes:
| // https://github.com/slsa-framework/slsa/blob/main/spec/dependency-provenance.md | ||
| syntax = "proto3"; | ||
|
|
||
| package slsa.dependency.v1; |
Member
There was a problem hiding this comment.
In the other protos we have a subpath to namespace the predicates:
Suggested change
| package slsa.dependency.v1; | |
| package slsa.predicates.dependency.v1; |
| import "google/protobuf/timestamp.proto"; | ||
|
|
||
| option go_package = "github.com/slsa-framework/protos/dependency/v1"; | ||
| option java_package = "dev.slsa.dependency.v1"; |
Member
There was a problem hiding this comment.
Suggested change
| option java_package = "dev.slsa.dependency.v1"; | |
| option java_package = "dev.slsa.predicates.dependency.v1"; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the first predicate schema in this repo: the SLSA Dependency Ingestion
Provenance predicate defined by the SLSA Dependency Track
(merged as slsa-framework/slsa#1627).
dependency/v1/dependency.proto—DependencyIngestionProvenancemessage plus supporting messages (Ingestor, IngestionPlatform, UpstreamRef,
IngestionEvent, ResolvedFromRef, Scan/Scanner, IntegrityVerdict,
PublisherSignatureVerdict, PolicyEvaluation/Policy, UpstreamAttestationRef,
SigningIsolation, IngestionIsolation).
README.md: documents the layout convention<predicate>/<version>/<predicate>.proto, package / go_package /java_package naming, and notes that Build / VSA / Source predicate schemas
currently live in slsa-framework/slsa and are expected to migrate here
over time.
Conventions established here
Since this is the first substantive PR to this repo, it also sets a few
conventions worth naming explicitly (see the README):
<predicate>/<version>/<predicate>.protoslsa.<predicate>.<version>(e.g.slsa.dependency.v1)go_package:github.com/slsa-framework/protos/<predicate>/<version>java_package:dev.slsa.<predicate>.<version>string(notenum) for implementer extensibilitythe schema; validation is left to the users of these protos.
Happy to iterate on any of these.
Related
content: Rename upstreamProvenance to upstreamAttestations slsa#1648 — this proto reflects the
renamed shape.
Test plan
protoc --proto_path=. --descriptor_set_out=/dev/null dependency/v1/dependency.proto— compiles cleanly underprotoc 35.1buf.yaml+ CI (lint, breaking-change detection) as a separate PR