Class: SlsaBuildDefinition

The inputs to a build, in enough detail to initialize it and begin execution; the builder vouches for their accuracy.

URI: slsa:SlsaBuildDefinition

 classDiagram
    class SlsaBuildDefinition
    click SlsaBuildDefinition href "../SlsaBuildDefinition/"
      SlsaBuildDefinition : build_type
        
      SlsaBuildDefinition : external_parameters
        
          
    
        
        
        SlsaBuildDefinition --> "1..*" SlsaBuildParameter : external_parameters
        click SlsaBuildParameter href "../SlsaBuildParameter/"
    

        
      SlsaBuildDefinition : hermetic
        
      SlsaBuildDefinition : internal_parameters
        
          
    
        
        
        SlsaBuildDefinition --> "*" SlsaBuildParameter : internal_parameters
        click SlsaBuildParameter href "../SlsaBuildParameter/"
    

        
      SlsaBuildDefinition : pipeline_orchestrator
        
      SlsaBuildDefinition : provenance_generation_tool
        
      SlsaBuildDefinition : resolved_dependencies
        
          
    
        
        
        SlsaBuildDefinition --> "*" InTotoResourceDescriptor : resolved_dependencies
        click InTotoResourceDescriptor href "../InTotoResourceDescriptor/"
    

        
      

Slots

Name	Cardinality and Range	Description	Inheritance
build_type	1 InTotoTypeUri	The URI of the template that says how to run the build and read its parameter…	direct
external_parameters	1..* SlsaBuildParameter	The inputs under the tenant’s control; required at Build L1, complete at Buil…	direct
internal_parameters	* SlsaBuildParameter	The inputs the platform sets itself; kept for debugging, incident response an…	direct
resolved_dependencies	* InTotoResourceDescriptor	The artifacts fetched during the build, as far as the platform knows them; co…	direct
hermetic	0..1 Boolean	Whether the build could reach only the dependencies it declared, with no othe…	direct
provenance_generation_tool	0..1 Uri	The tool that generated this provenance, named by URI	direct
pipeline_orchestrator	0..1 Uri	The CI/CD system that coordinated the build, named by URI, where it differs f…	direct

Usages

used by	used in	type	used
SlsaBuildProvenance	build_definition	range	SlsaBuildDefinition

In Subsets

• slsa_build_track

See Also

• https://slsa.dev/spec/v1.2/build-provenance#builddefinition

Identifier and Mapping Information

Schema Source

• from schema: https://w3id.org/lmodel/slsa

Mappings

Mapping Type	Mapped Value
self	slsa:SlsaBuildDefinition
native	slsa:SlsaBuildDefinition

LinkML Source

Direct

name: SlsaBuildDefinition
description: The inputs to a build, in enough detail to initialize it and begin execution;
  the builder vouches for their accuracy.
in_subset:
- slsa_build_track
from_schema: https://w3id.org/lmodel/slsa
see_also:
- https://slsa.dev/spec/v1.2/build-provenance#builddefinition
attributes:
  build_type:
    name: build_type
    description: The URI of the template that says how to run the build and read its
      parameters and dependencies; required at Build L1.
    from_schema: https://w3id.org/lmodel/slsa/slsa_build
    rank: 1000
    domain_of:
    - SlsaBuildDefinition
    range: in_toto_type_uri
    required: true
  external_parameters:
    name: external_parameters
    description: The inputs under the tenant's control; required at Build L1, complete
      at Build L3 and verified by consumers.
    comments:
    - Verifiers reject parameters they do not recognize here.
    from_schema: https://w3id.org/lmodel/slsa/slsa_build
    rank: 1000
    domain_of:
    - SlsaBuildDefinition
    range: SlsaBuildParameter
    required: true
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  internal_parameters:
    name: internal_parameters
    description: The inputs the platform sets itself; kept for debugging, incident
      response and reproduction, and not verified by consumers.
    from_schema: https://w3id.org/lmodel/slsa/slsa_build
    rank: 1000
    domain_of:
    - SlsaBuildDefinition
    range: SlsaBuildParameter
    multivalued: true
    inlined: true
    inlined_as_list: true
  resolved_dependencies:
    name: resolved_dependencies
    description: The artifacts fetched during the build, as far as the platform knows
      them; completeness is best effort through Build L3.
    from_schema: https://w3id.org/lmodel/slsa/slsa_build
    rank: 1000
    domain_of:
    - SlsaBuildDefinition
    range: InTotoResourceDescriptor
    multivalued: true
    inlined: true
    inlined_as_list: true
  hermetic:
    name: hermetic
    description: Whether the build could reach only the dependencies it declared,
      with no other network or filesystem access.
    comments:
    - SLSA v1.2 does not require hermetic builds; Build L3's isolation is a different
      property, and hermeticity is a candidate for a future Build L4.
    - The study cites a 2023 industry survey in which over half the participants found
      hermetic builds hard to implement, and lists "hermetic build" among SLSA's unclear
      terms (Tamanna et al., 2024, UC.1).
    in_subset:
    - slsa_adoption_study
    from_schema: https://w3id.org/lmodel/slsa/slsa_build
    rank: 1000
    domain_of:
    - SlsaBuildDefinition
    range: boolean
  provenance_generation_tool:
    name: provenance_generation_tool
    description: The tool that generated this provenance, named by URI.
    comments:
    - Naming the generator supports the strategy of standardizing provenance generation
      (Tamanna et al., 2024, S3.1).
    in_subset:
    - slsa_adoption_study
    from_schema: https://w3id.org/lmodel/slsa/slsa_build
    rank: 1000
    domain_of:
    - SlsaBuildDefinition
    range: uri
  pipeline_orchestrator:
    name: pipeline_orchestrator
    description: The CI/CD system that coordinated the build, named by URI, where
      it differs from the builder.
    comments:
    - In the Secure Software Factory architecture this is the Build Service layer,
      distinct from the provenance-generating builder.
    in_subset:
    - slsa_ssf
    from_schema: https://w3id.org/lmodel/slsa/slsa_build
    rank: 1000
    domain_of:
    - SlsaBuildDefinition
    range: uri

Induced

name: SlsaBuildDefinition
description: The inputs to a build, in enough detail to initialize it and begin execution;
  the builder vouches for their accuracy.
in_subset:
- slsa_build_track
from_schema: https://w3id.org/lmodel/slsa
see_also:
- https://slsa.dev/spec/v1.2/build-provenance#builddefinition
attributes:
  build_type:
    name: build_type
    description: The URI of the template that says how to run the build and read its
      parameters and dependencies; required at Build L1.
    from_schema: https://w3id.org/lmodel/slsa/slsa_build
    rank: 1000
    owner: SlsaBuildDefinition
    domain_of:
    - SlsaBuildDefinition
    range: in_toto_type_uri
    required: true
  external_parameters:
    name: external_parameters
    description: The inputs under the tenant's control; required at Build L1, complete
      at Build L3 and verified by consumers.
    comments:
    - Verifiers reject parameters they do not recognize here.
    from_schema: https://w3id.org/lmodel/slsa/slsa_build
    rank: 1000
    owner: SlsaBuildDefinition
    domain_of:
    - SlsaBuildDefinition
    range: SlsaBuildParameter
    required: true
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  internal_parameters:
    name: internal_parameters
    description: The inputs the platform sets itself; kept for debugging, incident
      response and reproduction, and not verified by consumers.
    from_schema: https://w3id.org/lmodel/slsa/slsa_build
    rank: 1000
    owner: SlsaBuildDefinition
    domain_of:
    - SlsaBuildDefinition
    range: SlsaBuildParameter
    multivalued: true
    inlined: true
    inlined_as_list: true
  resolved_dependencies:
    name: resolved_dependencies
    description: The artifacts fetched during the build, as far as the platform knows
      them; completeness is best effort through Build L3.
    from_schema: https://w3id.org/lmodel/slsa/slsa_build
    rank: 1000
    owner: SlsaBuildDefinition
    domain_of:
    - SlsaBuildDefinition
    range: InTotoResourceDescriptor
    multivalued: true
    inlined: true
    inlined_as_list: true
  hermetic:
    name: hermetic
    description: Whether the build could reach only the dependencies it declared,
      with no other network or filesystem access.
    comments:
    - SLSA v1.2 does not require hermetic builds; Build L3's isolation is a different
      property, and hermeticity is a candidate for a future Build L4.
    - The study cites a 2023 industry survey in which over half the participants found
      hermetic builds hard to implement, and lists "hermetic build" among SLSA's unclear
      terms (Tamanna et al., 2024, UC.1).
    in_subset:
    - slsa_adoption_study
    from_schema: https://w3id.org/lmodel/slsa/slsa_build
    rank: 1000
    owner: SlsaBuildDefinition
    domain_of:
    - SlsaBuildDefinition
    range: boolean
  provenance_generation_tool:
    name: provenance_generation_tool
    description: The tool that generated this provenance, named by URI.
    comments:
    - Naming the generator supports the strategy of standardizing provenance generation
      (Tamanna et al., 2024, S3.1).
    in_subset:
    - slsa_adoption_study
    from_schema: https://w3id.org/lmodel/slsa/slsa_build
    rank: 1000
    owner: SlsaBuildDefinition
    domain_of:
    - SlsaBuildDefinition
    range: uri
  pipeline_orchestrator:
    name: pipeline_orchestrator
    description: The CI/CD system that coordinated the build, named by URI, where
      it differs from the builder.
    comments:
    - In the Secure Software Factory architecture this is the Build Service layer,
      distinct from the provenance-generating builder.
    in_subset:
    - slsa_ssf
    from_schema: https://w3id.org/lmodel/slsa/slsa_build
    rank: 1000
    owner: SlsaBuildDefinition
    domain_of:
    - SlsaBuildDefinition
    range: uri