{"datasets/generated-artefacts":{"title":"Generated artifacts","type":"Dataset","genre":"reference","label":"checked by automation only, still a draft","tone":"automation","definition":"Files generated from the slsa schema and never edited by hand, committed or git-ignored: the two merged schemas in docs/schema/, the Python data models, project/ (JSON Schema, OWL, SHACL, Java and more), docs/elements/ and the bundle's domain schema .lokf/slsa.yaml, which a release also attaches as its schema asset."},"datasets/slsa-linkml-schema":{"title":"slsa LinkML schema","type":"Dataset","genre":"reference","label":"checked by automation only, still a draft","tone":"automation","definition":"The modular LinkML schema of the SLSA specification v1.2 (schema id `https://w3id.org/lmodel/slsa`): `slsa.yaml` imports a core module and one module per track, predicate or study, covering the Build, Source, Dependency and Build Environment tracks; the core imports the in-toto statement layer from lmodel/in-toto's vendored core module and adds SlsaStatement; its `lokf adapt` copy in `.lokf/slsa.yaml` is the bundle's domain schema."},"datasets/slsa-spec-copy":{"title":"SLSA specification copy","type":"Dataset","genre":"reference","label":"checked by automation only, still a draft","tone":"automation","definition":"The SLSA specification's Markdown pages, images and provenance schemas (.proto, .cue) copied into `src/slsa/schema/spec/`: all 39 files are identical to `docs/spec/draft/` at SLSA tag v1.2, and a weekly workflow watches for a newer release."},"datasets/test-data":{"title":"Test data","type":"Dataset","genre":"reference","label":"checked by automation only, still a draft","tone":"automation","definition":"Example YAML instances of the slsa schema in tests/data/, valid and invalid, named ClassName-###.yaml after the class they instantiate (SlsaStatement, InTotoDigestSet, SlsaBuildPlatform and the rest); pytest and linkml-run-examples check them."},"explanations/schema-subsets":{"title":"Schema subsets","type":"Explanation","genre":"explanation","label":"checked by automation only, still a draft","tone":"automation","definition":"Why the slsa schema tags its elements with six subsets (one per SLSA track: Build, Source, Dependency and Build Environment, plus slsa_ssf and slsa_adoption_study for what two outside sources add), and what each subset covers."},"glossary/slsa-level":{"title":"SLSA level","type":"Glossary term","genre":"reference","label":"checked by automation only, still a draft","tone":"automation","definition":"A rung within a SLSA track, such as Build L2 or Source L3; higher levels give better guarantees against supply chain threats at a higher cost to implement. The schema names them in its four level enums, such as SlsaBuildLevel."},"glossary/slsa-track":{"title":"SLSA track","type":"Glossary term","genre":"reference","label":"checked by automation only, still a draft","tone":"automation","definition":"A SLSA track focuses on one aspect of a software supply chain (Build, Source, Dependency or Build Environment), with its own levels, threats and requirements; the schema gives each track a subset and a level enum."},"org/cncf-tag-security":{"title":"CNCF TAG-Security","type":"Organization","genre":"reference","label":"checked by automation only, still a draft","tone":"automation","definition":"The CNCF Security Technical Advisory Group, publisher of the Secure Software Factory whitepaper from its cncf/tag-security repository (now archived), which licenses its documentation under CC BY 4.0."},"org/slsa-project":{"title":"SLSA project (OpenSSF)","type":"Organization","genre":"reference","label":"checked by automation only, still a draft","tone":"automation","definition":"The OpenSSF project that publishes the SLSA specification from the slsa-framework/slsa repository, governed by a steering committee and licensed under the Community Specification License 1.0."},"playbooks/knowledge-sources":{"title":"Knowledge sources map","type":"Playbook","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The librarian's scrape map: every repository location and external URL this bundle derives concepts from, and how to re-verify each on a refresh run."},"playbooks/regenerate-and-test":{"title":"Regenerate and test the schema","type":"Playbook","genre":"how-to","label":"checked by automation only, still a draft","tone":"automation","definition":"How to change the slsa schema and its modules, regenerate the artifacts, the docs and the bundle's domain schema with just (gen-project, gen-doc, gen-merged, lokf-adapt), then run the checks CI runs: just test on Python 3.10 to 3.14, and just lint and just lokf-adapt-check on 3.13."},"playbooks/release":{"title":"Release the slsa package","type":"Playbook","genre":"how-to","label":"checked by automation only, still a draft","tone":"automation","definition":"How a releasing commit merged to main makes semantic-release promote the changelog, tag vX.Y.Z and publish a GitHub Release, and how pypi-publish.yaml then publishes slsa-linkml to PyPI once PYPI_RELEASE_ENABLED is true."},"policies/license-and-attribution":{"title":"License and attribution","type":"Policy","genre":"reference","label":"checked by automation only, still a draft","tone":"automation","definition":"Which license covers what in the slsa repository: Apache-2.0 for the schema and code, the SLSA specification copy under the Community Specification License 1.0 (older portions Apache-2.0) with its name, version and source given in NOTICE, the whitepaper under CC BY 4.0, lmodel/in-toto's vendored core module under Apache-2.0, and what else NOTICE lists."},"references/in-toto-attestation":{"title":"in-toto attestation framework","type":"Reference","genre":"reference","label":"nobody has checked this yet, still a draft","tone":"nobody","definition":"The in-toto attestation framework (spec v1), whose Statement, ResourceDescriptor and DigestSet layers carry SLSA provenance and verification summaries; the schema takes its InToto classes, InTotoPredicate and three field types from lmodel/in-toto's core module at v0.1.0, vendored unchanged in src/slsa/schema/in_toto/, with every digest algorithm the DigestSet page lists."},"references/openssf-supply-chain":{"title":"OpenSSF Supply Chain Integrity Working Group","type":"Reference","genre":"reference","label":"checked by automation only, still a draft","tone":"automation","definition":"The OpenSSF Supply Chain Integrity Working Group, whose software supply chain projects include SLSA, Sigstore, GUAC, gittuf and Security Insights; the schema's guac_uri and security_insights_uri slots point at GUAC and Security Insights."},"references/secure-software-factory":{"title":"CNCF Secure Software Factory whitepaper","type":"Reference","genre":"reference","label":"checked by automation only, still a draft","tone":"automation","definition":"The CNCF TAG-Security Secure Software Factory whitepaper (2022), which describes a pipeline of version control, build service, artifact registry, signing service and policy engine; the schema's slsa_ssf subset takes five slots from it."},"references/slsa-adoption-study":{"title":"SLSA adoption study (Tamanna et al., 2024)","type":"Reference","genre":"reference","label":"checked by automation only, still a draft","tone":"automation","definition":"An empirical study by Tamanna et al. (2024, arXiv:2409.05014) of 1,523 SLSA-related GitHub issues from 233 repositories; the schema's slsa_adoption module encodes its four challenge and five strategy themes as enums on SlsaAdoptionMetadata."},"references/slsa-specification":{"title":"SLSA specification","type":"Reference","genre":"reference","label":"checked by automation only, still a draft","tone":"automation","definition":"Supply-chain Levels for Software Artifacts (SLSA), the OpenSSF specification of tracks and levels for supply chain security; the slsa LinkML schema renders version 1.2, its Build and Source tracks, and the working draft's Dependency and Build Environment tracks."},"services/documentation-site":{"title":"slsa documentation site","type":"Service","genre":"reference","label":"checked by automation only, still a draft","tone":"automation","definition":"The Astro Starlight site in `website/`, built from the README, `docs/`, the schema's gen-doc pages and the knowledge bundle by the Knowledge website workflow, which publishes it at `https://lmodel.github.io/slsa/` once `KNOWLEDGE_WEBSITE_ENABLED` is true. Its `REDIRECTS` setting sends the retired mkdocs site's page addresses, such as `/elements/<name>`, on to the new pages."}}