Enum: SlsaAdoptionChallenge

The four themes of difficulty practitioners met when adopting SLSA.

URI: slsa:SlsaAdoptionChallenge

Permissible Values

Value	Meaning	Description
COMPLEX_IMPLEMENTATION	None	Generating provenance and maintaining the required tools is complicated
UNCLEAR_COMMUNICATION	None	SLSA’s terms and its guidance for particular ecosystems are hard to understan…
LIMITED_FEASIBILITY	None	Verification tooling, attestation storage and two-party review are hard to pu…
UNCLEAR_RELEVANCE	None	Which attacks SLSA mitigates, and how it differs from other practices, is unc…

Slots

Name	Description
challenges	The challenge themes that apply

In Subsets

• slsa_adoption_study

See Also

• https://arxiv.org/abs/2409.05014

Identifier and Mapping Information

Schema Source

• from schema: https://w3id.org/lmodel/slsa

LinkML Source

name: SlsaAdoptionChallenge
description: The four themes of difficulty practitioners met when adopting SLSA.
in_subset:
- slsa_adoption_study
from_schema: https://w3id.org/lmodel/slsa
see_also:
- https://arxiv.org/abs/2409.05014
rank: 1000
permissible_values:
  COMPLEX_IMPLEMENTATION:
    text: COMPLEX_IMPLEMENTATION
    description: Generating provenance and maintaining the required tools is complicated.
    annotations:
      study_theme:
        tag: study_theme
        value: CI
    comments:
    - 'Sub-themes: complicated provenance generation (CI.1) and intricate tool maintenance
      (CI.2); 901 issues.'
  UNCLEAR_COMMUNICATION:
    text: UNCLEAR_COMMUNICATION
    description: SLSA's terms and its guidance for particular ecosystems are hard
      to understand.
    annotations:
      study_theme:
        tag: study_theme
        value: UC
    comments:
    - 'Sub-themes: unclear definitions of key terms (UC.1) and unclear documentation,
      such as how to apply SLSA in an ecosystem (UC.2); 357 issues.'
  LIMITED_FEASIBILITY:
    text: LIMITED_FEASIBILITY
    description: Verification tooling, attestation storage and two-party review are
      hard to put into practice.
    annotations:
      study_theme:
        tag: study_theme
        value: LF
    comments:
    - 'Sub-themes: limited attestation verification, including where attestations
      are stored (LF.1), and two-party review requirements, which projects with one
      maintainer find hard to meet (LF.2); 219 issues.'
  UNCLEAR_RELEVANCE:
    text: UNCLEAR_RELEVANCE
    description: Which attacks SLSA mitigates, and how it differs from other practices,
      is unclear.
    annotations:
      study_theme:
        tag: study_theme
        value: UR
    comments:
    - 'Sub-theme: unclear relevance, including tools that name one package differently
      within an ecosystem (UR.1); 46 issues.'