Class: SlsaDependencyInventory

The inventory of every third-party build dependency, direct and transitive, of one artifact version.

URI: slsa:SlsaDependencyInventory

 classDiagram
    class SlsaDependencyInventory
    click SlsaDependencyInventory href "../SlsaDependencyInventory/"
      SlsaDependencyInventory : artifact
        
          
    
        
        
        SlsaDependencyInventory --> "1" InTotoResourceDescriptor : artifact
        click InTotoResourceDescriptor href "../InTotoResourceDescriptor/"
    

        
      SlsaDependencyInventory : dependencies
        
          
    
        
        
        SlsaDependencyInventory --> "*" InTotoResourceDescriptor : dependencies
        click InTotoResourceDescriptor href "../InTotoResourceDescriptor/"
    

        
      SlsaDependencyInventory : dependency_level
        
          
    
        
        
        SlsaDependencyInventory --> "0..1" SlsaDependencyLevel : dependency_level
        click SlsaDependencyLevel href "../SlsaDependencyLevel/"
    

        
      

Slots

Name	Cardinality and Range	Description	Inheritance
artifact	1 InTotoResourceDescriptor	The artifact whose dependencies are inventoried	direct
dependencies	* InTotoResourceDescriptor	The dependencies, each as a resource descriptor	direct
dependency_level	0..1 SlsaDependencyLevel	The SLSA Dependency level the producer’s process meets for this artifact	direct

Usages

used by	used in	type	used
SlsaDocument	dependency_inventories	range	SlsaDependencyInventory

In Subsets

• slsa_dependency_track

Comments

• The Dependency track is a working draft and not part of the SLSA v1.2 release.
• A build-time SBOM or a lock file with hashes is a common form of the inventory.

See Also

• https://slsa.dev/spec/draft/dependency-track

Identifier and Mapping Information

Schema Source

• from schema: https://w3id.org/lmodel/slsa

Mappings

Mapping Type	Mapped Value
self	slsa:SlsaDependencyInventory
native	slsa:SlsaDependencyInventory

LinkML Source

Direct

name: SlsaDependencyInventory
description: The inventory of every third-party build dependency, direct and transitive,
  of one artifact version.
comments:
- The Dependency track is a working draft and not part of the SLSA v1.2 release.
- A build-time SBOM or a lock file with hashes is a common form of the inventory.
in_subset:
- slsa_dependency_track
from_schema: https://w3id.org/lmodel/slsa
see_also:
- https://slsa.dev/spec/draft/dependency-track
attributes:
  artifact:
    name: artifact
    description: The artifact whose dependencies are inventoried.
    from_schema: https://w3id.org/lmodel/slsa/slsa_dependency
    rank: 1000
    domain_of:
    - SlsaDependencyInventory
    range: InTotoResourceDescriptor
    required: true
    inlined: true
  dependencies:
    name: dependencies
    description: The dependencies, each as a resource descriptor.
    from_schema: https://w3id.org/lmodel/slsa/slsa_dependency
    rank: 1000
    domain_of:
    - SlsaDependencyInventory
    range: InTotoResourceDescriptor
    multivalued: true
    inlined: true
    inlined_as_list: true
  dependency_level:
    name: dependency_level
    description: The SLSA Dependency level the producer's process meets for this artifact.
    from_schema: https://w3id.org/lmodel/slsa/slsa_dependency
    rank: 1000
    domain_of:
    - SlsaDependencyInventory
    range: SlsaDependencyLevel

Induced

name: SlsaDependencyInventory
description: The inventory of every third-party build dependency, direct and transitive,
  of one artifact version.
comments:
- The Dependency track is a working draft and not part of the SLSA v1.2 release.
- A build-time SBOM or a lock file with hashes is a common form of the inventory.
in_subset:
- slsa_dependency_track
from_schema: https://w3id.org/lmodel/slsa
see_also:
- https://slsa.dev/spec/draft/dependency-track
attributes:
  artifact:
    name: artifact
    description: The artifact whose dependencies are inventoried.
    from_schema: https://w3id.org/lmodel/slsa/slsa_dependency
    rank: 1000
    owner: SlsaDependencyInventory
    domain_of:
    - SlsaDependencyInventory
    range: InTotoResourceDescriptor
    required: true
    inlined: true
  dependencies:
    name: dependencies
    description: The dependencies, each as a resource descriptor.
    from_schema: https://w3id.org/lmodel/slsa/slsa_dependency
    rank: 1000
    owner: SlsaDependencyInventory
    domain_of:
    - SlsaDependencyInventory
    range: InTotoResourceDescriptor
    multivalued: true
    inlined: true
    inlined_as_list: true
  dependency_level:
    name: dependency_level
    description: The SLSA Dependency level the producer's process meets for this artifact.
    from_schema: https://w3id.org/lmodel/slsa/slsa_dependency
    rank: 1000
    owner: SlsaDependencyInventory
    domain_of:
    - SlsaDependencyInventory
    range: SlsaDependencyLevel