From 8c4b99aa6a6eafa15963d2cc6d5e7bbfcf788e74 Mon Sep 17 00:00:00 2001 From: "Adolfo Garcia Veytia (puerco)" Date: Sat, 2 Aug 2025 01:00:04 -0600 Subject: [PATCH] Don't set the PROVENANCE_AVAILABLE since to now This commit removes the now() date when computing PROVENANCE_AVAILABLE as it always moves the compliance date to the time the latest attestation was generated. Signed-off-by: Adolfo Garcia Veytia (puerco) --- pkg/attest/provenance.go | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/pkg/attest/provenance.go b/pkg/attest/provenance.go index 0426d590..825f0c92 100644 --- a/pkg/attest/provenance.go +++ b/pkg/attest/provenance.go @@ -139,7 +139,14 @@ func (pa ProvenanceAttestor) createCurrentProvenance(ctx context.Context, commit curProvPred.Controls = controlStatus.Controls // At the very least provenance is available starting now. :) - curProvPred.AddControl(&provenance.Control{Name: slsa.ProvenanceAvailable.String(), Since: timestamppb.New(curTime)}) + // ... indeed, but don't set the `since`` date because doing so breaks + // checking against policies. + // See https://github.com/slsa-framework/slsa-source-poc/issues/272 + curProvPred.AddControl( + &provenance.Control{ + Name: slsa.ProvenanceAvailable.String(), + }, + ) return addPredToStatement(&curProvPred, provenance.SourceProvPredicateType, commit) }