Class: SlsaVerificationSummary

The predicate in which a verifier records that it evaluated artifacts against a policy and the SLSA levels they met, so consumers can rely on the verifier instead of reading every underlying attestation.

URI: slsa:SlsaVerificationSummary

 classDiagram
    class SlsaVerificationSummary
    click SlsaVerificationSummary href "../SlsaVerificationSummary/"
      SlsaPredicate <|-- SlsaVerificationSummary
        click SlsaPredicate href "../SlsaPredicate/"
      
      SlsaVerificationSummary : dependency_levels
        
          
    
        
        
        SlsaVerificationSummary --> "*" SlsaDependencyLevelCount : dependency_levels
        click SlsaDependencyLevelCount href "../SlsaDependencyLevelCount/"
    

        
      SlsaVerificationSummary : input_attestations
        
          
    
        
        
        SlsaVerificationSummary --> "*" SlsaVerificationSummaryInputAttestation : input_attestations
        click SlsaVerificationSummaryInputAttestation href "../SlsaVerificationSummaryInputAttestation/"
    

        
      SlsaVerificationSummary : organization_properties
        
      SlsaVerificationSummary : policy
        
          
    
        
        
        SlsaVerificationSummary --> "1" SlsaVerificationSummaryPolicy : policy
        click SlsaVerificationSummaryPolicy href "../SlsaVerificationSummaryPolicy/"
    

        
      SlsaVerificationSummary : predicate_kind
        
      SlsaVerificationSummary : resource_uri
        
      SlsaVerificationSummary : slsa_version
        
      SlsaVerificationSummary : time_verified
        
      SlsaVerificationSummary : verification_result
        
          
    
        
        
        SlsaVerificationSummary --> "1" SlsaVerificationResult : verification_result
        click SlsaVerificationResult href "../SlsaVerificationResult/"
    

        
      SlsaVerificationSummary : verified_levels
        
      SlsaVerificationSummary : verifier
        
          
    
        
        
        SlsaVerificationSummary --> "1" SlsaVerifier : verifier
        click SlsaVerifier href "../SlsaVerifier/"
    

        
      

Inheritance

• InTotoPredicate
  • SlsaPredicate
    • SlsaVerificationSummary

Slots

Name	Cardinality and Range	Description	Inheritance
resource_uri	1 InTotoResourceUri	The URI consumers fetch the artifact from, which the verifier verified it as	direct
verifier	1 SlsaVerifier	The verifier that made this determination	direct
time_verified	0..1 InTotoTimestamp	When the verification happened	direct
policy	1 SlsaVerificationSummaryPolicy	The policy the subject was verified against, by URI and preferably by digest …	direct
input_attestations	* SlsaVerificationSummaryInputAttestation	Every attestation the verifier consulted, each with a digest; complete when p…	direct
verification_result	1 SlsaVerificationResult	Whether the subject passed the policy	direct
verified_levels	1..* SlsaResultValue	The highest level verified in each track, any verified property, and any resu…	direct
organization_properties	* String	Properties the organization defines for the revision, each prefixed ORG_SOURC…	direct
dependency_levels	* SlsaDependencyLevelCount	How many transitive dependencies were verified at each level; absent when the…	direct
slsa_version	0..1 String	The SLSA specification version the verifier applied, as MAJOR	direct
predicate_kind	0..1 String	The kind of predicate, one of this class’s descendants	InTotoPredicate

In Subsets

• slsa_build_track
• slsa_source_track

Comments

• The statement that carries it has predicate_type https://slsa.dev/verification_summary/v1.
• A Source VSA is this predicate with the repository as resource_uri and the revision id in the subject’s digest.
• Verification tooling and the places attestations are stored were an adoption difficulty practitioners reported (Tamanna et al., 2024, LF.1).

See Also

• https://slsa.dev/spec/v1.2/verification_summary
• https://slsa.dev/spec/v1.2/source-requirements#source-verification-summary-attestation

Identifier and Mapping Information

Schema Source

• from schema: https://w3id.org/lmodel/slsa

Mappings

Mapping Type	Mapped Value
self	slsa:SlsaVerificationSummary
native	slsa:SlsaVerificationSummary

LinkML Source

Direct

name: SlsaVerificationSummary
description: The predicate in which a verifier records that it evaluated artifacts
  against a policy and the SLSA levels they met, so consumers can rely on the verifier
  instead of reading every underlying attestation.
comments:
- The statement that carries it has predicate_type https://slsa.dev/verification_summary/v1.
- A Source VSA is this predicate with the repository as resource_uri and the revision
  id in the subject's digest.
- Verification tooling and the places attestations are stored were an adoption difficulty
  practitioners reported (Tamanna et al., 2024, LF.1).
in_subset:
- slsa_build_track
- slsa_source_track
from_schema: https://w3id.org/lmodel/slsa
see_also:
- https://slsa.dev/spec/v1.2/verification_summary
- https://slsa.dev/spec/v1.2/source-requirements#source-verification-summary-attestation
is_a: SlsaPredicate
slots:
- resource_uri
slot_usage:
  resource_uri:
    name: resource_uri
    description: The URI consumers fetch the artifact from, which the verifier verified
      it as.
    required: true
attributes:
  verifier:
    name: verifier
    description: The verifier that made this determination.
    from_schema: https://w3id.org/lmodel/slsa/slsa_verification
    rank: 1000
    domain_of:
    - SlsaVerificationSummary
    range: SlsaVerifier
    required: true
    inlined: true
  time_verified:
    name: time_verified
    description: When the verification happened.
    from_schema: https://w3id.org/lmodel/slsa/slsa_verification
    rank: 1000
    domain_of:
    - SlsaVerificationSummary
    range: in_toto_timestamp
  policy:
    name: policy
    description: The policy the subject was verified against, by URI and preferably
      by digest too.
    from_schema: https://w3id.org/lmodel/slsa/slsa_verification
    rank: 1000
    domain_of:
    - SlsaVerificationSummary
    range: SlsaVerificationSummaryPolicy
    required: true
    inlined: true
  input_attestations:
    name: input_attestations
    description: Every attestation the verifier consulted, each with a digest; complete
      when present.
    from_schema: https://w3id.org/lmodel/slsa/slsa_verification
    rank: 1000
    domain_of:
    - SlsaVerificationSummary
    range: SlsaVerificationSummaryInputAttestation
    multivalued: true
    inlined: true
    inlined_as_list: true
  verification_result:
    name: verification_result
    description: Whether the subject passed the policy.
    from_schema: https://w3id.org/lmodel/slsa/slsa_verification
    rank: 1000
    domain_of:
    - SlsaVerificationSummary
    range: SlsaVerificationResult
    required: true
  verified_levels:
    name: verified_levels
    description: The highest level verified in each track, any verified property,
      and any result of the issuer's own; a level implies the levels below it.
    comments:
    - A VSA lists at most one level per track, and only FAILED when verification failed;
      the validator checks neither.
    from_schema: https://w3id.org/lmodel/slsa/slsa_verification
    rank: 1000
    domain_of:
    - SlsaVerificationSummary
    range: slsa_result_value
    required: true
    multivalued: true
    pattern: ^(SLSA_BUILD_LEVEL_(UNEVALUATED|[0-3])|SLSA_SOURCE_LEVEL_(UNEVALUATED|[0-4])|SLSA_SOURCE_TWO_PARTY_REVIEWED|SLSA_BUILD_REPRODUCED|([!-RT-rt-~]|[Ss]$|[Ss][!-KM-km-~]|[Ss][Ll]$|[Ss][Ll][!-RT-rt-~]|[Ss][Ll][Ss]$|[Ss][Ll][Ss][!-@B-`b-~]|[Ss][Ll][Ss][Aa]$|[Ss][Ll][Ss][Aa][!-^`-~])[!-~]*)$
    minimum_cardinality: 1
  organization_properties:
    name: organization_properties
    description: Properties the organization defines for the revision, each prefixed
      ORG_SOURCE_; ORG_SOURCE_INTERNAL_ marks one not meant for external consumers.
    deprecated: Write these properties in verified_levels, where the attestation's
      JSON puts them; this field goes in a later release.
    in_subset:
    - slsa_source_track
    from_schema: https://w3id.org/lmodel/slsa/slsa_verification
    deprecated_element_has_possible_replacement: slsa:verified_levels
    rank: 1000
    domain_of:
    - SlsaVerificationSummary
    multivalued: true
    pattern: ^ORG_SOURCE_
  dependency_levels:
    name: dependency_levels
    description: How many transitive dependencies were verified at each level; absent
      when the verifier makes no claim about dependencies.
    comments:
    - The attestation's JSON tells an empty map (no dependencies) from an absent one
      (no claim); this list cannot, so an empty list reads as no claim.
    from_schema: https://w3id.org/lmodel/slsa/slsa_verification
    rank: 1000
    domain_of:
    - SlsaVerificationSummary
    range: SlsaDependencyLevelCount
    multivalued: true
    inlined: true
    inlined_as_list: true
  slsa_version:
    name: slsa_version
    description: The SLSA specification version the verifier applied, as MAJOR.MINOR.
    from_schema: https://w3id.org/lmodel/slsa/slsa_verification
    rank: 1000
    domain_of:
    - SlsaVerificationSummary
    pattern: ^[0-9]+\.[0-9]+$

Induced

name: SlsaVerificationSummary
description: The predicate in which a verifier records that it evaluated artifacts
  against a policy and the SLSA levels they met, so consumers can rely on the verifier
  instead of reading every underlying attestation.
comments:
- The statement that carries it has predicate_type https://slsa.dev/verification_summary/v1.
- A Source VSA is this predicate with the repository as resource_uri and the revision
  id in the subject's digest.
- Verification tooling and the places attestations are stored were an adoption difficulty
  practitioners reported (Tamanna et al., 2024, LF.1).
in_subset:
- slsa_build_track
- slsa_source_track
from_schema: https://w3id.org/lmodel/slsa
see_also:
- https://slsa.dev/spec/v1.2/verification_summary
- https://slsa.dev/spec/v1.2/source-requirements#source-verification-summary-attestation
is_a: SlsaPredicate
slot_usage:
  resource_uri:
    name: resource_uri
    description: The URI consumers fetch the artifact from, which the verifier verified
      it as.
    required: true
attributes:
  verifier:
    name: verifier
    description: The verifier that made this determination.
    from_schema: https://w3id.org/lmodel/slsa/slsa_verification
    rank: 1000
    owner: SlsaVerificationSummary
    domain_of:
    - SlsaVerificationSummary
    range: SlsaVerifier
    required: true
    inlined: true
  time_verified:
    name: time_verified
    description: When the verification happened.
    from_schema: https://w3id.org/lmodel/slsa/slsa_verification
    rank: 1000
    owner: SlsaVerificationSummary
    domain_of:
    - SlsaVerificationSummary
    range: in_toto_timestamp
  policy:
    name: policy
    description: The policy the subject was verified against, by URI and preferably
      by digest too.
    from_schema: https://w3id.org/lmodel/slsa/slsa_verification
    rank: 1000
    owner: SlsaVerificationSummary
    domain_of:
    - SlsaVerificationSummary
    range: SlsaVerificationSummaryPolicy
    required: true
    inlined: true
  input_attestations:
    name: input_attestations
    description: Every attestation the verifier consulted, each with a digest; complete
      when present.
    from_schema: https://w3id.org/lmodel/slsa/slsa_verification
    rank: 1000
    owner: SlsaVerificationSummary
    domain_of:
    - SlsaVerificationSummary
    range: SlsaVerificationSummaryInputAttestation
    multivalued: true
    inlined: true
    inlined_as_list: true
  verification_result:
    name: verification_result
    description: Whether the subject passed the policy.
    from_schema: https://w3id.org/lmodel/slsa/slsa_verification
    rank: 1000
    owner: SlsaVerificationSummary
    domain_of:
    - SlsaVerificationSummary
    range: SlsaVerificationResult
    required: true
  verified_levels:
    name: verified_levels
    description: The highest level verified in each track, any verified property,
      and any result of the issuer's own; a level implies the levels below it.
    comments:
    - A VSA lists at most one level per track, and only FAILED when verification failed;
      the validator checks neither.
    from_schema: https://w3id.org/lmodel/slsa/slsa_verification
    rank: 1000
    owner: SlsaVerificationSummary
    domain_of:
    - SlsaVerificationSummary
    range: slsa_result_value
    required: true
    multivalued: true
    pattern: ^(SLSA_BUILD_LEVEL_(UNEVALUATED|[0-3])|SLSA_SOURCE_LEVEL_(UNEVALUATED|[0-4])|SLSA_SOURCE_TWO_PARTY_REVIEWED|SLSA_BUILD_REPRODUCED|([!-RT-rt-~]|[Ss]$|[Ss][!-KM-km-~]|[Ss][Ll]$|[Ss][Ll][!-RT-rt-~]|[Ss][Ll][Ss]$|[Ss][Ll][Ss][!-@B-`b-~]|[Ss][Ll][Ss][Aa]$|[Ss][Ll][Ss][Aa][!-^`-~])[!-~]*)$
    minimum_cardinality: 1
  organization_properties:
    name: organization_properties
    description: Properties the organization defines for the revision, each prefixed
      ORG_SOURCE_; ORG_SOURCE_INTERNAL_ marks one not meant for external consumers.
    deprecated: Write these properties in verified_levels, where the attestation's
      JSON puts them; this field goes in a later release.
    in_subset:
    - slsa_source_track
    from_schema: https://w3id.org/lmodel/slsa/slsa_verification
    deprecated_element_has_possible_replacement: slsa:verified_levels
    rank: 1000
    owner: SlsaVerificationSummary
    domain_of:
    - SlsaVerificationSummary
    range: string
    multivalued: true
    pattern: ^ORG_SOURCE_
  dependency_levels:
    name: dependency_levels
    description: How many transitive dependencies were verified at each level; absent
      when the verifier makes no claim about dependencies.
    comments:
    - The attestation's JSON tells an empty map (no dependencies) from an absent one
      (no claim); this list cannot, so an empty list reads as no claim.
    from_schema: https://w3id.org/lmodel/slsa/slsa_verification
    rank: 1000
    owner: SlsaVerificationSummary
    domain_of:
    - SlsaVerificationSummary
    range: SlsaDependencyLevelCount
    multivalued: true
    inlined: true
    inlined_as_list: true
  slsa_version:
    name: slsa_version
    description: The SLSA specification version the verifier applied, as MAJOR.MINOR.
    from_schema: https://w3id.org/lmodel/slsa/slsa_verification
    rank: 1000
    owner: SlsaVerificationSummary
    domain_of:
    - SlsaVerificationSummary
    range: string
    pattern: ^[0-9]+\.[0-9]+$
  resource_uri:
    name: resource_uri
    description: The URI consumers fetch the artifact from, which the verifier verified
      it as.
    from_schema: https://w3id.org/lmodel/slsa
    see_also:
    - https://github.com/in-toto/attestation/blob/v1.2.0/spec/v1/field_types.md#resourceuri
    rank: 1000
    slot_uri: in_toto_linkml:resource_uri
    owner: SlsaVerificationSummary
    domain_of:
    - SlsaVerificationSummary
    - InTotoResourceDescriptor
    range: in_toto_resource_uri
    required: true
  predicate_kind:
    name: predicate_kind
    description: The kind of predicate, one of this class's descendants.
    from_schema: https://w3id.org/lmodel/in-toto/in_toto_core
    rank: 1000
    slot_uri: in_toto_linkml:predicate_kind
    designates_type: true
    owner: SlsaVerificationSummary
    domain_of:
    - InTotoPredicate
    range: string