Policies

• License and attribution checked by automation only, still a draft
  Which license covers what in the slsa repository: Apache-2.0 for the schema and code, the SLSA specification copy under the Community Specification License 1.0 (older portions Apache-2.0) with its name, version and source given in NOTICE, the whitepaper under CC BY 4.0, lmodel/in-toto’s vendored core module under Apache-2.0, and what else NOTICE lists.