Class: SlsaVerificationSummaryInputAttestation

One attestation a verifier consulted: a resource descriptor that carries the attestation’s digest.

URI: slsa:SlsaVerificationSummaryInputAttestation

 classDiagram
    class SlsaVerificationSummaryInputAttestation
    click SlsaVerificationSummaryInputAttestation href "../SlsaVerificationSummaryInputAttestation/"
      InTotoResourceDescriptor <|-- SlsaVerificationSummaryInputAttestation
        click InTotoResourceDescriptor href "../InTotoResourceDescriptor/"
      
      SlsaVerificationSummaryInputAttestation : annotations
        
          
    
        
        
        SlsaVerificationSummaryInputAttestation --> "*" InTotoAnnotation : annotations
        click InTotoAnnotation href "../InTotoAnnotation/"
    

        
      SlsaVerificationSummaryInputAttestation : content
        
      SlsaVerificationSummaryInputAttestation : digest
        
          
    
        
        
        SlsaVerificationSummaryInputAttestation --> "1" InTotoDigestSet : digest
        click InTotoDigestSet href "../InTotoDigestSet/"
    

        
      SlsaVerificationSummaryInputAttestation : download_location
        
      SlsaVerificationSummaryInputAttestation : media_type
        
      SlsaVerificationSummaryInputAttestation : resource_name
        
      SlsaVerificationSummaryInputAttestation : resource_uri
        
      

Inheritance

• InTotoResourceDescriptor
  • SlsaVerificationSummaryInputAttestation

Slots

Name	Cardinality and Range	Description	Inheritance
resource_uri	0..1 recommended InTotoResourceUri	The URI that identifies a resource, such as a package URL, a git repository a…	InTotoResourceDescriptor
digest	1 InTotoDigestSet	The cryptographic digests of a resource’s content, keyed by algorithm	InTotoResourceDescriptor
resource_name	0..1 String	A name for the resource within the attestation that carries it	InTotoResourceDescriptor
download_location	0..1 InTotoResourceUri	Where the resource can be fetched, when that differs from its identifying URI	InTotoResourceDescriptor
media_type	0..1 String	The IANA media type of the resource’s content	InTotoResourceDescriptor
content	0..1 String	The resource’s content itself, base64-encoded, for a resource small enough to…	InTotoResourceDescriptor
annotations	* InTotoAnnotation	Vendor-specific annotations on the resource, such as the source references a …	InTotoResourceDescriptor

Usages

used by	used in	type	used
SlsaVerificationSummary	input_attestations	range	SlsaVerificationSummaryInputAttestation

In Subsets

• slsa_build_track
• slsa_source_track

See Also

• https://slsa.dev/spec/v1.2/verification_summary#inputAttestations

Identifier and Mapping Information

Schema Source

• from schema: https://w3id.org/lmodel/slsa

Mappings

Mapping Type	Mapped Value
self	slsa:SlsaVerificationSummaryInputAttestation
native	slsa:SlsaVerificationSummaryInputAttestation

LinkML Source

Direct

name: SlsaVerificationSummaryInputAttestation
description: 'One attestation a verifier consulted: a resource descriptor that carries
  the attestation''s digest.'
in_subset:
- slsa_build_track
- slsa_source_track
from_schema: https://w3id.org/lmodel/slsa
see_also:
- https://slsa.dev/spec/v1.2/verification_summary#inputAttestations
is_a: InTotoResourceDescriptor
slot_usage:
  digest:
    name: digest
    required: true
  resource_uri:
    name: resource_uri
    recommended: true

Induced

name: SlsaVerificationSummaryInputAttestation
description: 'One attestation a verifier consulted: a resource descriptor that carries
  the attestation''s digest.'
in_subset:
- slsa_build_track
- slsa_source_track
from_schema: https://w3id.org/lmodel/slsa
see_also:
- https://slsa.dev/spec/v1.2/verification_summary#inputAttestations
is_a: InTotoResourceDescriptor
slot_usage:
  digest:
    name: digest
    required: true
  resource_uri:
    name: resource_uri
    recommended: true
attributes:
  resource_uri:
    name: resource_uri
    description: The URI that identifies a resource, such as a package URL, a git
      repository address or an OCI image reference.
    from_schema: https://w3id.org/lmodel/slsa
    see_also:
    - https://github.com/in-toto/attestation/blob/v1.2.0/spec/v1/field_types.md#resourceuri
    rank: 1000
    slot_uri: in_toto_linkml:resource_uri
    owner: SlsaVerificationSummaryInputAttestation
    domain_of:
    - SlsaVerificationSummary
    - InTotoResourceDescriptor
    range: in_toto_resource_uri
    recommended: true
  digest:
    name: digest
    description: The cryptographic digests of a resource's content, keyed by algorithm.
    from_schema: https://w3id.org/lmodel/slsa
    see_also:
    - https://github.com/in-toto/attestation/blob/v1.2.0/spec/v1/digest_set.md
    rank: 1000
    slot_uri: in_toto_linkml:digest
    owner: SlsaVerificationSummaryInputAttestation
    domain_of:
    - InTotoResourceDescriptor
    - SlsaMeasurement
    range: InTotoDigestSet
    required: true
    inlined: true
  resource_name:
    name: resource_name
    description: A name for the resource within the attestation that carries it.
    from_schema: https://w3id.org/lmodel/in-toto/in_toto_core
    rank: 1000
    slot_uri: in_toto_linkml:resource_name
    owner: SlsaVerificationSummaryInputAttestation
    domain_of:
    - InTotoResourceDescriptor
    range: string
  download_location:
    name: download_location
    description: Where the resource can be fetched, when that differs from its identifying
      URI.
    from_schema: https://w3id.org/lmodel/in-toto/in_toto_core
    rank: 1000
    slot_uri: in_toto_linkml:download_location
    owner: SlsaVerificationSummaryInputAttestation
    domain_of:
    - InTotoResourceDescriptor
    range: in_toto_resource_uri
  media_type:
    name: media_type
    description: The IANA media type of the resource's content.
    from_schema: https://w3id.org/lmodel/in-toto/in_toto_core
    rank: 1000
    slot_uri: dcat:mediaType
    owner: SlsaVerificationSummaryInputAttestation
    domain_of:
    - InTotoResourceDescriptor
    range: string
  content:
    name: content
    description: The resource's content itself, base64-encoded, for a resource small
      enough to carry inline.
    comments:
    - The in-toto framework asks for content under 1 KB, so that attestations stay
      small.
    from_schema: https://w3id.org/lmodel/in-toto/in_toto_core
    rank: 1000
    slot_uri: in_toto_linkml:content
    owner: SlsaVerificationSummaryInputAttestation
    domain_of:
    - InTotoResourceDescriptor
    range: string
    pattern: ^[A-Za-z0-9+/_-]+={0,2}$
  annotations:
    name: annotations
    description: Vendor-specific annotations on the resource, such as the source references
      a SLSA Source Verification Summary records.
    from_schema: https://w3id.org/lmodel/in-toto/in_toto_core
    rank: 1000
    slot_uri: in_toto_linkml:annotations
    owner: SlsaVerificationSummaryInputAttestation
    domain_of:
    - InTotoResourceDescriptor
    range: InTotoAnnotation
    multivalued: true
    inlined: true
    inlined_as_list: true