Skip to content
SLSA

All versions since 0.7.1

All versions

0.7.1

As it stood at this release: the repository · the docs · the knowledge bundle · the release

Security

  • The sidecar copies and the skills pin are at Knowledge Trust Ladder v0.59.0. The release changed .github/workflows/knowledge-registrar.yaml, .github/workflows/knowledge-librarian.yaml, .github/workflows/knowledge-release.yaml, .github/workflows/knowledge-sync.yaml, .lokf/scripts/knowledge-conventions.sh, .lokf/scripts/knowledge-conventions.py, .lokf/scripts/knowledge-preflight.sh, .lokf/scripts/knowledge-apply.sh, .lokf/scripts/knowledge-apply.py, .lokf/scripts/knowledge-report.sh, .lokf/m365/ktl-docent-m365.md, website/package-lock.json, website/package.json, website/scripts/config.mjs and .github/workflows/knowledge-website.yaml here.

0.8.0 Latest

As it stood at this release: the repository · the docs · the knowledge bundle · the release

Changed

  • The in-toto layer comes from lmodel/in-toto’s core module at v0.1.0, vendored at src/slsa/schema/in_toto/in_toto_core.yaml, and the schema’s own copy is gone. The class names stay, and the six classes and their keys take in-toto’s IRIs; media_type and algorithm take the IRIs LOKF gives them.
  • SlsaPredicate extends in-toto’s InTotoPredicate. A statement keeps its predicate key, which the adapt copy calls slsa_predicate, because LOKF’s predicate is a relation’s type.
  • attestation_storage_uri, signing_tool and transparency_log_entry moved to SlsaStatement, a subclass of InTotoStatement that SlsaDocument holds, since in-toto’s statement carries only what its specification defines.
  • build_type, builder_id and verifier_id take in-toto’s in_toto_type_uri, and started_on, finished_on and time_verified take in_toto_timestamp, the field types the SLSA specification gives them. A timestamp now ends in Z, and a type URI keeps its scheme and host in lowercase.