Class: InTotoResourceDescriptor

A reference to a software artifact or other resource by URI or digest, or the resource itself as content, with optional metadata.

URI: slsa:InTotoResourceDescriptor

 classDiagram
    class InTotoResourceDescriptor
    click InTotoResourceDescriptor href "../InTotoResourceDescriptor/"
      InTotoResourceDescriptor <|-- SlsaVerificationSummaryPolicy
        click SlsaVerificationSummaryPolicy href "../SlsaVerificationSummaryPolicy/"
      InTotoResourceDescriptor <|-- SlsaVerificationSummaryInputAttestation
        click SlsaVerificationSummaryInputAttestation href "../SlsaVerificationSummaryInputAttestation/"
      InTotoResourceDescriptor <|-- InTotoStatementSubject
        click InTotoStatementSubject href "../InTotoStatementSubject/"
      
      InTotoResourceDescriptor : annotations
        
          
    
        
        
        InTotoResourceDescriptor --> "*" InTotoAnnotation : annotations
        click InTotoAnnotation href "../InTotoAnnotation/"
    

        
      InTotoResourceDescriptor : content
        
      InTotoResourceDescriptor : digest
        
          
    
        
        
        InTotoResourceDescriptor --> "0..1" InTotoDigestSet : digest
        click InTotoDigestSet href "../InTotoDigestSet/"
    

        
      InTotoResourceDescriptor : download_location
        
      InTotoResourceDescriptor : media_type
        
      InTotoResourceDescriptor : resource_name
        
      InTotoResourceDescriptor : resource_uri

Inheritance

InTotoResourceDescriptor

Slots

Name	Cardinality and Range	Description	Inheritance
resource_uri	0..1 InTotoResourceUri	The URI that identifies a resource, such as a package URL, a git repository a…	direct
digest	0..1 InTotoDigestSet	The cryptographic digests of a resource’s content, keyed by algorithm	direct
resource_name	0..1 String	A name for the resource within the attestation that carries it	direct
download_location	0..1 InTotoResourceUri	Where the resource can be fetched, when that differs from its identifying URI	direct
media_type	0..1 String	The IANA media type of the resource’s content	direct
content	0..1 String	The resource’s content itself, base64-encoded, for a resource small enough to…	direct
annotations	* InTotoAnnotation	Vendor-specific annotations on the resource, such as the source references a …	direct

Expressions & Logic

Any Of

The class must satisfy at least one of:

AnonymousClassExpression({ ‘slot_conditions’: {‘resource_uri’: SlotDefinition({ ‘name’: ‘resource_uri’, ‘required’: True, ‘any_of’: [AnonymousSlotExpression({‘range’: ‘uri’})] })} })
AnonymousClassExpression({ ‘slot_conditions’: {‘digest’: SlotDefinition({ ‘name’: ‘digest’, ‘required’: True, ‘any_of’: [AnonymousSlotExpression({‘range’: ‘InTotoDigestSet’})] })} })
AnonymousClassExpression({ ‘slot_conditions’: {‘content’: SlotDefinition({ ‘name’: ‘content’, ‘required’: True, ‘any_of’: [AnonymousSlotExpression({‘range’: ‘string’})] })} })

Usages

used by	used in	type	used
SlsaBuildPlatform	builder_dependencies	range	InTotoResourceDescriptor
SlsaPackage	package_artifacts	range	InTotoResourceDescriptor
SlsaBuildDefinition	resolved_dependencies	range	InTotoResourceDescriptor
SlsaRunDetails	byproducts	range	InTotoResourceDescriptor
SlsaDependencyInventory	artifact	range	InTotoResourceDescriptor
SlsaDependencyInventory	dependencies	range	InTotoResourceDescriptor

Comments

A descriptor carries at least one of a URI, a digest or its content; a field that needs a particular one says so.

Notes

Each condition in any_of names its range through a nested any_of, because the JSON Schema generator leaves a condition’s own range out, and a null value would then count as present.

Identifier and Mapping Information

Schema Source

from schema: https://w3id.org/lmodel/slsa

Mappings

Mapping Type	Mapped Value
self	slsa:InTotoResourceDescriptor
native	slsa:InTotoResourceDescriptor

LinkML Source

Direct

name: InTotoResourceDescriptor
description: A reference to a software artifact or other resource by URI or digest,
  or the resource itself as content, with optional metadata.
notes:
- Each condition in any_of names its range through a nested any_of, because the JSON
  Schema generator leaves a condition's own range out, and a null value would then
  count as present.
comments:
- A descriptor carries at least one of a URI, a digest or its content; a field that
  needs a particular one says so.
from_schema: https://w3id.org/lmodel/slsa
see_also:
- https://github.com/in-toto/attestation/blob/v1.2.0/spec/v1/resource_descriptor.md
slots:
- resource_uri
- digest
attributes:
  resource_name:
    name: resource_name
    description: A name for the resource within the attestation that carries it.
    from_schema: https://w3id.org/lmodel/in-toto/in_toto_core
    rank: 1000
    slot_uri: in_toto_linkml:resource_name
    domain_of:
    - InTotoResourceDescriptor
  download_location:
    name: download_location
    description: Where the resource can be fetched, when that differs from its identifying
      URI.
    from_schema: https://w3id.org/lmodel/in-toto/in_toto_core
    rank: 1000
    slot_uri: in_toto_linkml:download_location
    domain_of:
    - InTotoResourceDescriptor
    range: in_toto_resource_uri
  media_type:
    name: media_type
    description: The IANA media type of the resource's content.
    from_schema: https://w3id.org/lmodel/in-toto/in_toto_core
    rank: 1000
    slot_uri: dcat:mediaType
    domain_of:
    - InTotoResourceDescriptor
  content:
    name: content
    description: The resource's content itself, base64-encoded, for a resource small
      enough to carry inline.
    comments:
    - The in-toto framework asks for content under 1 KB, so that attestations stay
      small.
    from_schema: https://w3id.org/lmodel/in-toto/in_toto_core
    rank: 1000
    slot_uri: in_toto_linkml:content
    domain_of:
    - InTotoResourceDescriptor
    pattern: ^[A-Za-z0-9+/_-]+={0,2}$
  annotations:
    name: annotations
    description: Vendor-specific annotations on the resource, such as the source references
      a SLSA Source Verification Summary records.
    from_schema: https://w3id.org/lmodel/in-toto/in_toto_core
    rank: 1000
    slot_uri: in_toto_linkml:annotations
    domain_of:
    - InTotoResourceDescriptor
    range: InTotoAnnotation
    multivalued: true
    inlined: true
    inlined_as_list: true
any_of:
- slot_conditions:
    resource_uri:
      name: resource_uri
      required: true
      any_of:
      - range: uri
- slot_conditions:
    digest:
      name: digest
      required: true
      any_of:
      - range: InTotoDigestSet
- slot_conditions:
    content:
      name: content
      required: true
      any_of:
      - range: string

Induced

name: InTotoResourceDescriptor
description: A reference to a software artifact or other resource by URI or digest,
  or the resource itself as content, with optional metadata.
notes:
- Each condition in any_of names its range through a nested any_of, because the JSON
  Schema generator leaves a condition's own range out, and a null value would then
  count as present.
comments:
- A descriptor carries at least one of a URI, a digest or its content; a field that
  needs a particular one says so.
from_schema: https://w3id.org/lmodel/slsa
see_also:
- https://github.com/in-toto/attestation/blob/v1.2.0/spec/v1/resource_descriptor.md
attributes:
  resource_name:
    name: resource_name
    description: A name for the resource within the attestation that carries it.
    from_schema: https://w3id.org/lmodel/in-toto/in_toto_core
    rank: 1000
    slot_uri: in_toto_linkml:resource_name
    owner: InTotoResourceDescriptor
    domain_of:
    - InTotoResourceDescriptor
    range: string
  download_location:
    name: download_location
    description: Where the resource can be fetched, when that differs from its identifying
      URI.
    from_schema: https://w3id.org/lmodel/in-toto/in_toto_core
    rank: 1000
    slot_uri: in_toto_linkml:download_location
    owner: InTotoResourceDescriptor
    domain_of:
    - InTotoResourceDescriptor
    range: in_toto_resource_uri
  media_type:
    name: media_type
    description: The IANA media type of the resource's content.
    from_schema: https://w3id.org/lmodel/in-toto/in_toto_core
    rank: 1000
    slot_uri: dcat:mediaType
    owner: InTotoResourceDescriptor
    domain_of:
    - InTotoResourceDescriptor
    range: string
  content:
    name: content
    description: The resource's content itself, base64-encoded, for a resource small
      enough to carry inline.
    comments:
    - The in-toto framework asks for content under 1 KB, so that attestations stay
      small.
    from_schema: https://w3id.org/lmodel/in-toto/in_toto_core
    rank: 1000
    slot_uri: in_toto_linkml:content
    owner: InTotoResourceDescriptor
    domain_of:
    - InTotoResourceDescriptor
    range: string
    pattern: ^[A-Za-z0-9+/_-]+={0,2}$
  annotations:
    name: annotations
    description: Vendor-specific annotations on the resource, such as the source references
      a SLSA Source Verification Summary records.
    from_schema: https://w3id.org/lmodel/in-toto/in_toto_core
    rank: 1000
    slot_uri: in_toto_linkml:annotations
    owner: InTotoResourceDescriptor
    domain_of:
    - InTotoResourceDescriptor
    range: InTotoAnnotation
    multivalued: true
    inlined: true
    inlined_as_list: true
  resource_uri:
    name: resource_uri
    description: The URI that identifies a resource, such as a package URL, a git
      repository address or an OCI image reference.
    from_schema: https://w3id.org/lmodel/slsa
    see_also:
    - https://github.com/in-toto/attestation/blob/v1.2.0/spec/v1/field_types.md#resourceuri
    rank: 1000
    slot_uri: in_toto_linkml:resource_uri
    owner: InTotoResourceDescriptor
    domain_of:
    - SlsaVerificationSummary
    - InTotoResourceDescriptor
    range: in_toto_resource_uri
  digest:
    name: digest
    description: The cryptographic digests of a resource's content, keyed by algorithm.
    from_schema: https://w3id.org/lmodel/slsa
    see_also:
    - https://github.com/in-toto/attestation/blob/v1.2.0/spec/v1/digest_set.md
    rank: 1000
    slot_uri: in_toto_linkml:digest
    owner: InTotoResourceDescriptor
    domain_of:
    - InTotoResourceDescriptor
    - SlsaMeasurement
    range: InTotoDigestSet
    inlined: true
any_of:
- slot_conditions:
    resource_uri:
      name: resource_uri
      required: true
      any_of:
      - range: uri
- slot_conditions:
    digest:
      name: digest
      required: true
      any_of:
      - range: InTotoDigestSet
- slot_conditions:
    content:
      name: content
      required: true
      any_of:
      - range: string

Class: InTotoResourceDescriptor

Inheritance

Slots

Any Of

Usages

Comments

See Also

Notes

Identifier and Mapping Information

Schema Source

Mappings

LinkML Source

Direct

Induced