Skip to content
SLSA

Class: SlsaStatement

An in-toto statement with the fields this schema adds: where the signed attestation is stored, the tool that signed it and the transparency log entry that records the signature.

URI: slsa:SlsaStatement

 classDiagram
    class SlsaStatement
    click SlsaStatement href "../SlsaStatement/"
      InTotoStatement <|-- SlsaStatement
        click InTotoStatement href "../InTotoStatement/"
      
      SlsaStatement : attestation_storage_uri
        
      SlsaStatement : predicate
        
          
    
        
        
        SlsaStatement --> "0..1" InTotoPredicate : predicate
        click InTotoPredicate href "../InTotoPredicate/"
    

        
      SlsaStatement : predicate_type
        
      SlsaStatement : signing_tool
        
      SlsaStatement : statement_type
        
      SlsaStatement : subject
        
          
    
        
        
        SlsaStatement --> "1..*" InTotoStatementSubject : subject
        click InTotoStatementSubject href "../InTotoStatementSubject/"
    

        
      SlsaStatement : transparency_log_entry

Inheritance

Section titled “Inheritance”

Slots

Section titled “Slots”
Name Cardinality and Range Description Inheritance
attestation_storage_uri 0..1
Uri		 Where the signed attestation is stored or can be fetched direct
signing_tool 0..1
Uri		 The tool that signed the attestation, named by URI, such as Cosign or Notatio… direct
transparency_log_entry 0..1
Uri		 The transparency log entry that records the signature, such as a Rekor entry direct
predicate 0..1
InTotoPredicate		 The predicate, one of the kinds this schema or an importing one models; predi… InTotoStatement
statement_type 1
InTotoTypeUri		 The in-toto statement type, always https://in-toto InTotoStatement
subject 1..*
InTotoStatementSubject		 The artifacts the predicate is about, each with a digest InTotoStatement
predicate_type 1
InTotoTypeUri		 The URI that names the predicate’s type and so its schema, such as https://in… InTotoStatement

Usages

Section titled “Usages”
used by used in type used
SlsaDocument attestations range SlsaStatement

In Subsets

Section titled “In Subsets”

Comments

Section titled “Comments”
  • InTotoStatement comes from lmodel/in-toto and holds only what the in-toto specification defines, so the fields SLSA’s adoption study and the Secure Software Factory add live on this subclass. A statement without them is a valid SlsaStatement too.
  • Attestation and provenance are often confused; a statement is the attestation, and build provenance is one kind of predicate it may carry (Tamanna et al., 2024, UC.1).

See Also

Section titled “See Also”

Identifier and Mapping Information

Section titled “Identifier and Mapping Information”

Schema Source

Section titled “Schema Source”

Mappings

Section titled “Mappings”
Mapping Type Mapped Value
self slsa:SlsaStatement
native slsa:SlsaStatement

LinkML Source

Section titled “LinkML Source”

Direct

Section titled “Direct”
name: SlsaStatement
description: 'An in-toto statement with the fields this schema adds: where the signed
  attestation is stored, the tool that signed it and the transparency log entry that
  records the signature.'
comments:
- InTotoStatement comes from lmodel/in-toto and holds only what the in-toto specification
  defines, so the fields SLSA's adoption study and the Secure Software Factory add
  live on this subclass. A statement without them is a valid SlsaStatement too.
- Attestation and provenance are often confused; a statement is the attestation, and
  build provenance is one kind of predicate it may carry (Tamanna et al., 2024, UC.1).
in_subset:
- slsa_build_track
- slsa_source_track
- slsa_build_environment_track
from_schema: https://w3id.org/lmodel/slsa
see_also:
- https://slsa.dev/spec/v1.2/attestation-model
- https://slsa.dev/spec/v1.2/distributing-provenance
is_a: InTotoStatement
attributes:
  attestation_storage_uri:
    name: attestation_storage_uri
    description: Where the signed attestation is stored or can be fetched.
    comments:
    - 'SLSA asks producers to publish attestations in at least one place and preferably
      more: beside the source repository''s releases, beside the artifact in its package
      registry, which it prefers in the long term, or elsewhere with an entry in a
      transparency log.'
    - Where to store attestations was an open question for practitioners (Tamanna
      et al., 2024, LF.1).
    in_subset:
    - slsa_adoption_study
    from_schema: https://w3id.org/lmodel/slsa/slsa_core
    rank: 1000
    domain_of:
    - SlsaStatement
    range: uri
  signing_tool:
    name: signing_tool
    description: The tool that signed the attestation, named by URI, such as Cosign
      or Notation.
    in_subset:
    - slsa_ssf
    from_schema: https://w3id.org/lmodel/slsa/slsa_core
    rank: 1000
    domain_of:
    - SlsaStatement
    range: uri
  transparency_log_entry:
    name: transparency_log_entry
    description: The transparency log entry that records the signature, such as a
      Rekor entry.
    in_subset:
    - slsa_ssf
    from_schema: https://w3id.org/lmodel/slsa/slsa_core
    rank: 1000
    domain_of:
    - SlsaStatement
    range: uri

Induced

Section titled “Induced”
name: SlsaStatement
description: 'An in-toto statement with the fields this schema adds: where the signed
  attestation is stored, the tool that signed it and the transparency log entry that
  records the signature.'
comments:
- InTotoStatement comes from lmodel/in-toto and holds only what the in-toto specification
  defines, so the fields SLSA's adoption study and the Secure Software Factory add
  live on this subclass. A statement without them is a valid SlsaStatement too.
- Attestation and provenance are often confused; a statement is the attestation, and
  build provenance is one kind of predicate it may carry (Tamanna et al., 2024, UC.1).
in_subset:
- slsa_build_track
- slsa_source_track
- slsa_build_environment_track
from_schema: https://w3id.org/lmodel/slsa
see_also:
- https://slsa.dev/spec/v1.2/attestation-model
- https://slsa.dev/spec/v1.2/distributing-provenance
is_a: InTotoStatement
attributes:
  attestation_storage_uri:
    name: attestation_storage_uri
    description: Where the signed attestation is stored or can be fetched.
    comments:
    - 'SLSA asks producers to publish attestations in at least one place and preferably
      more: beside the source repository''s releases, beside the artifact in its package
      registry, which it prefers in the long term, or elsewhere with an entry in a
      transparency log.'
    - Where to store attestations was an open question for practitioners (Tamanna
      et al., 2024, LF.1).
    in_subset:
    - slsa_adoption_study
    from_schema: https://w3id.org/lmodel/slsa/slsa_core
    rank: 1000
    owner: SlsaStatement
    domain_of:
    - SlsaStatement
    range: uri
  signing_tool:
    name: signing_tool
    description: The tool that signed the attestation, named by URI, such as Cosign
      or Notation.
    in_subset:
    - slsa_ssf
    from_schema: https://w3id.org/lmodel/slsa/slsa_core
    rank: 1000
    owner: SlsaStatement
    domain_of:
    - SlsaStatement
    range: uri
  transparency_log_entry:
    name: transparency_log_entry
    description: The transparency log entry that records the signature, such as a
      Rekor entry.
    in_subset:
    - slsa_ssf
    from_schema: https://w3id.org/lmodel/slsa/slsa_core
    rank: 1000
    owner: SlsaStatement
    domain_of:
    - SlsaStatement
    range: uri
  predicate:
    name: predicate
    description: The predicate, one of the kinds this schema or an importing one models;
      predicate_kind names which. Unset means the same as empty.
    comments:
    - 'It is a slot of its own rather than an attribute of InTotoStatement, because
      LOKF''s predicate is a relation''s type: `lokf adapt` renames a slot whose name
      LOKF defines and keeps its IRI, so a copy beside LOKF calls it in_toto_linkml_predicate.'
    from_schema: https://w3id.org/lmodel/slsa
    see_also:
    - https://github.com/in-toto/attestation/blob/v1.2.0/spec/v1/statement.md
    rank: 1000
    slot_uri: in_toto_linkml:predicate
    owner: SlsaStatement
    domain_of:
    - InTotoStatement
    range: InTotoPredicate
    inlined: true
  statement_type:
    name: statement_type
    description: The in-toto statement type, always https://in-toto.io/Statement/v1.
    from_schema: https://w3id.org/lmodel/in-toto/in_toto_core
    rank: 1000
    slot_uri: in_toto_linkml:statement_type
    owner: SlsaStatement
    domain_of:
    - InTotoStatement
    range: in_toto_type_uri
    required: true
    pattern: ^https://in-toto\.io/Statement/v1$
  subject:
    name: subject
    description: The artifacts the predicate is about, each with a digest.
    from_schema: https://w3id.org/lmodel/in-toto/in_toto_core
    rank: 1000
    slot_uri: in_toto_linkml:subject
    owner: SlsaStatement
    domain_of:
    - InTotoStatement
    range: InTotoStatementSubject
    required: true
    multivalued: true
    inlined: true
    inlined_as_list: true
    minimum_cardinality: 1
  predicate_type:
    name: predicate_type
    description: The URI that names the predicate's type and so its schema, such as
      https://in-toto.io/attestation/test-result/v0.1.
    from_schema: https://w3id.org/lmodel/in-toto/in_toto_core
    rank: 1000
    slot_uri: in_toto_linkml:predicate_type
    owner: SlsaStatement
    domain_of:
    - InTotoStatement
    range: in_toto_type_uri
    required: true