Class: SlsaPackage

A unit of software distributed under a package name, which is the primary security boundary SLSA protects. Its artifacts are the outputs of builds.

URI: slsa:SlsaPackage

 classDiagram
    class SlsaPackage
    click SlsaPackage href "../SlsaPackage/"
      SlsaPackage : ecosystem
        
      SlsaPackage : guac_uri
        
      SlsaPackage : package_artifacts
        
          
    
        
        
        SlsaPackage --> "*" InTotoResourceDescriptor : package_artifacts
        click InTotoResourceDescriptor href "../InTotoResourceDescriptor/"
    

        
      SlsaPackage : package_name
        
      SlsaPackage : registry
        
          
    
        
        
        SlsaPackage --> "0..1" SlsaPackageRegistry : registry
        click SlsaPackageRegistry href "../SlsaPackageRegistry/"
    

        
      SlsaPackage : security_insights_uri
        
      

Slots

Name	Cardinality and Range	Description	Inheritance
ecosystem	0..1 String	The package ecosystem whose rules govern how a package is named and distribut…	direct
package_name	1 String	The name consumers use to obtain the package within its ecosystem and registr…	direct
registry	0..1 SlsaPackageRegistry	The registry the package is published to	direct
package_artifacts	* InTotoResourceDescriptor	The immutable artifacts the package name has resolved to	direct
guac_uri	0..1 Uri	Where a GUAC instance answers queries about the package’s dependency and prov…	direct
security_insights_uri	0..1 Uri	The SECURITY-INSIGHTS	direct

Usages

used by	used in	type	used
SlsaDocument	packages	range	SlsaPackage

In Subsets

• slsa_build_track
• slsa_dependency_track

See Also

• https://slsa.dev/spec/v1.2/terminology#distribution-model

Identifier and Mapping Information

Schema Source

• from schema: https://w3id.org/lmodel/slsa

Mappings

Mapping Type	Mapped Value
self	slsa:SlsaPackage
native	slsa:SlsaPackage

LinkML Source

Direct

name: SlsaPackage
description: A unit of software distributed under a package name, which is the primary
  security boundary SLSA protects. Its artifacts are the outputs of builds.
in_subset:
- slsa_build_track
- slsa_dependency_track
from_schema: https://w3id.org/lmodel/slsa
see_also:
- https://slsa.dev/spec/v1.2/terminology#distribution-model
slots:
- ecosystem
attributes:
  package_name:
    name: package_name
    description: The name consumers use to obtain the package within its ecosystem
      and registry.
    from_schema: https://w3id.org/lmodel/slsa/slsa_core
    rank: 1000
    domain_of:
    - SlsaPackage
    required: true
  registry:
    name: registry
    description: The registry the package is published to.
    from_schema: https://w3id.org/lmodel/slsa/slsa_core
    rank: 1000
    domain_of:
    - SlsaPackage
    range: SlsaPackageRegistry
  package_artifacts:
    name: package_artifacts
    description: The immutable artifacts the package name has resolved to.
    from_schema: https://w3id.org/lmodel/slsa/slsa_core
    rank: 1000
    domain_of:
    - SlsaPackage
    range: InTotoResourceDescriptor
    multivalued: true
    inlined: true
    inlined_as_list: true
  guac_uri:
    name: guac_uri
    description: Where a GUAC instance answers queries about the package's dependency
      and provenance graph.
    in_subset:
    - slsa_ssf
    from_schema: https://w3id.org/lmodel/slsa/slsa_core
    rank: 1000
    domain_of:
    - SlsaPackage
    range: uri
  security_insights_uri:
    name: security_insights_uri
    description: The SECURITY-INSIGHTS.yml file of the project that produces the package.
    in_subset:
    - slsa_ssf
    from_schema: https://w3id.org/lmodel/slsa/slsa_core
    rank: 1000
    domain_of:
    - SlsaPackage
    range: uri

Induced

name: SlsaPackage
description: A unit of software distributed under a package name, which is the primary
  security boundary SLSA protects. Its artifacts are the outputs of builds.
in_subset:
- slsa_build_track
- slsa_dependency_track
from_schema: https://w3id.org/lmodel/slsa
see_also:
- https://slsa.dev/spec/v1.2/terminology#distribution-model
attributes:
  package_name:
    name: package_name
    description: The name consumers use to obtain the package within its ecosystem
      and registry.
    from_schema: https://w3id.org/lmodel/slsa/slsa_core
    rank: 1000
    owner: SlsaPackage
    domain_of:
    - SlsaPackage
    range: string
    required: true
  registry:
    name: registry
    description: The registry the package is published to.
    from_schema: https://w3id.org/lmodel/slsa/slsa_core
    rank: 1000
    owner: SlsaPackage
    domain_of:
    - SlsaPackage
    range: SlsaPackageRegistry
  package_artifacts:
    name: package_artifacts
    description: The immutable artifacts the package name has resolved to.
    from_schema: https://w3id.org/lmodel/slsa/slsa_core
    rank: 1000
    owner: SlsaPackage
    domain_of:
    - SlsaPackage
    range: InTotoResourceDescriptor
    multivalued: true
    inlined: true
    inlined_as_list: true
  guac_uri:
    name: guac_uri
    description: Where a GUAC instance answers queries about the package's dependency
      and provenance graph.
    in_subset:
    - slsa_ssf
    from_schema: https://w3id.org/lmodel/slsa/slsa_core
    rank: 1000
    owner: SlsaPackage
    domain_of:
    - SlsaPackage
    range: uri
  security_insights_uri:
    name: security_insights_uri
    description: The SECURITY-INSIGHTS.yml file of the project that produces the package.
    in_subset:
    - slsa_ssf
    from_schema: https://w3id.org/lmodel/slsa/slsa_core
    rank: 1000
    owner: SlsaPackage
    domain_of:
    - SlsaPackage
    range: uri
  ecosystem:
    name: ecosystem
    description: The package ecosystem whose rules govern how a package is named and
      distributed, such as PyPA, npm or OCI.
    comments:
    - One ecosystem's tools can name the same package differently, which the study
      found affects attestations and provenance, so verifiers match provenance to
      package names with care (Tamanna et al., 2024, UR.1).
    in_subset:
    - slsa_build_track
    - slsa_dependency_track
    from_schema: https://w3id.org/lmodel/slsa
    rank: 1000
    slot_uri: slsa:ecosystem
    owner: SlsaPackage
    domain_of:
    - SlsaPackageRegistry
    - SlsaPackage
    range: string