Class: SlsaVerificationSummaryPolicy

The policy a verification summary applied: a resource descriptor that names the policy by URI.

URI: slsa:SlsaVerificationSummaryPolicy

 classDiagram
    class SlsaVerificationSummaryPolicy
    click SlsaVerificationSummaryPolicy href "../SlsaVerificationSummaryPolicy/"
      InTotoResourceDescriptor <|-- SlsaVerificationSummaryPolicy
        click InTotoResourceDescriptor href "../InTotoResourceDescriptor/"
      
      SlsaVerificationSummaryPolicy : annotations
        
          
    
        
        
        SlsaVerificationSummaryPolicy --> "*" InTotoAnnotation : annotations
        click InTotoAnnotation href "../InTotoAnnotation/"
    

        
      SlsaVerificationSummaryPolicy : content
        
      SlsaVerificationSummaryPolicy : digest
        
          
    
        
        
        SlsaVerificationSummaryPolicy --> "0..1 _recommended_" InTotoDigestSet : digest
        click InTotoDigestSet href "../InTotoDigestSet/"
    

        
      SlsaVerificationSummaryPolicy : download_location
        
      SlsaVerificationSummaryPolicy : media_type
        
      SlsaVerificationSummaryPolicy : resource_name
        
      SlsaVerificationSummaryPolicy : resource_uri
        
      

Inheritance

• InTotoResourceDescriptor
  • SlsaVerificationSummaryPolicy

Slots

Name	Cardinality and Range	Description	Inheritance
resource_uri	1 InTotoResourceUri	The URI that identifies a resource, such as a package URL, a git repository a…	InTotoResourceDescriptor
digest	0..1 recommended InTotoDigestSet	The cryptographic digests of a resource’s content, keyed by algorithm	InTotoResourceDescriptor
resource_name	0..1 String	A name for the resource within the attestation that carries it	InTotoResourceDescriptor
download_location	0..1 InTotoResourceUri	Where the resource can be fetched, when that differs from its identifying URI	InTotoResourceDescriptor
media_type	0..1 String	The IANA media type of the resource’s content	InTotoResourceDescriptor
content	0..1 String	The resource’s content itself, base64-encoded, for a resource small enough to…	InTotoResourceDescriptor
annotations	* InTotoAnnotation	Vendor-specific annotations on the resource, such as the source references a …	InTotoResourceDescriptor

Usages

used by	used in	type	used
SlsaVerificationSummary	policy	range	SlsaVerificationSummaryPolicy

In Subsets

• slsa_build_track
• slsa_source_track

Comments

• A digest is recommended as well, to pin the exact version of the policy.

See Also

• https://slsa.dev/spec/v1.2/verification_summary#policy

Identifier and Mapping Information

Schema Source

• from schema: https://w3id.org/lmodel/slsa

Mappings

Mapping Type	Mapped Value
self	slsa:SlsaVerificationSummaryPolicy
native	slsa:SlsaVerificationSummaryPolicy

LinkML Source

Direct

name: SlsaVerificationSummaryPolicy
description: 'The policy a verification summary applied: a resource descriptor that
  names the policy by URI.'
comments:
- A digest is recommended as well, to pin the exact version of the policy.
in_subset:
- slsa_build_track
- slsa_source_track
from_schema: https://w3id.org/lmodel/slsa
see_also:
- https://slsa.dev/spec/v1.2/verification_summary#policy
is_a: InTotoResourceDescriptor
slot_usage:
  resource_uri:
    name: resource_uri
    required: true
  digest:
    name: digest
    recommended: true

Induced

name: SlsaVerificationSummaryPolicy
description: 'The policy a verification summary applied: a resource descriptor that
  names the policy by URI.'
comments:
- A digest is recommended as well, to pin the exact version of the policy.
in_subset:
- slsa_build_track
- slsa_source_track
from_schema: https://w3id.org/lmodel/slsa
see_also:
- https://slsa.dev/spec/v1.2/verification_summary#policy
is_a: InTotoResourceDescriptor
slot_usage:
  resource_uri:
    name: resource_uri
    required: true
  digest:
    name: digest
    recommended: true
attributes:
  resource_uri:
    name: resource_uri
    description: The URI that identifies a resource, such as a package URL, a git
      repository address or an OCI image reference.
    from_schema: https://w3id.org/lmodel/slsa
    see_also:
    - https://github.com/in-toto/attestation/blob/v1.2.0/spec/v1/field_types.md#resourceuri
    rank: 1000
    slot_uri: in_toto_linkml:resource_uri
    owner: SlsaVerificationSummaryPolicy
    domain_of:
    - SlsaVerificationSummary
    - InTotoResourceDescriptor
    range: in_toto_resource_uri
    required: true
  digest:
    name: digest
    description: The cryptographic digests of a resource's content, keyed by algorithm.
    from_schema: https://w3id.org/lmodel/slsa
    see_also:
    - https://github.com/in-toto/attestation/blob/v1.2.0/spec/v1/digest_set.md
    rank: 1000
    slot_uri: in_toto_linkml:digest
    owner: SlsaVerificationSummaryPolicy
    domain_of:
    - InTotoResourceDescriptor
    - SlsaMeasurement
    range: InTotoDigestSet
    recommended: true
    inlined: true
  resource_name:
    name: resource_name
    description: A name for the resource within the attestation that carries it.
    from_schema: https://w3id.org/lmodel/in-toto/in_toto_core
    rank: 1000
    slot_uri: in_toto_linkml:resource_name
    owner: SlsaVerificationSummaryPolicy
    domain_of:
    - InTotoResourceDescriptor
    range: string
  download_location:
    name: download_location
    description: Where the resource can be fetched, when that differs from its identifying
      URI.
    from_schema: https://w3id.org/lmodel/in-toto/in_toto_core
    rank: 1000
    slot_uri: in_toto_linkml:download_location
    owner: SlsaVerificationSummaryPolicy
    domain_of:
    - InTotoResourceDescriptor
    range: in_toto_resource_uri
  media_type:
    name: media_type
    description: The IANA media type of the resource's content.
    from_schema: https://w3id.org/lmodel/in-toto/in_toto_core
    rank: 1000
    slot_uri: dcat:mediaType
    owner: SlsaVerificationSummaryPolicy
    domain_of:
    - InTotoResourceDescriptor
    range: string
  content:
    name: content
    description: The resource's content itself, base64-encoded, for a resource small
      enough to carry inline.
    comments:
    - The in-toto framework asks for content under 1 KB, so that attestations stay
      small.
    from_schema: https://w3id.org/lmodel/in-toto/in_toto_core
    rank: 1000
    slot_uri: in_toto_linkml:content
    owner: SlsaVerificationSummaryPolicy
    domain_of:
    - InTotoResourceDescriptor
    range: string
    pattern: ^[A-Za-z0-9+/_-]+={0,2}$
  annotations:
    name: annotations
    description: Vendor-specific annotations on the resource, such as the source references
      a SLSA Source Verification Summary records.
    from_schema: https://w3id.org/lmodel/in-toto/in_toto_core
    rank: 1000
    slot_uri: in_toto_linkml:annotations
    owner: SlsaVerificationSummaryPolicy
    domain_of:
    - InTotoResourceDescriptor
    range: InTotoAnnotation
    multivalued: true
    inlined: true
    inlined_as_list: true