Skip to content
SLSA

Slot: ecosystem

The package ecosystem whose rules govern how a package is named and distributed, such as PyPA, npm or OCI.

URI: slsa:ecosystem

Applicable Classes

Section titled “Applicable Classes”
Name Description Modifies Slot
SlsaPackageRegistry A distribution platform that resolves package names to immutable package arti… no
SlsaPackage A unit of software distributed under a package name, which is the primary sec… no

Properties

Section titled “Properties”

Type and Range

Section titled “Type and Range”
Property Value
Range String
Domain Of SlsaPackageRegistry, SlsaPackage
Slot URI slsa:ecosystem

In Subsets

Section titled “In Subsets”

Comments

Section titled “Comments”
  • One ecosystem’s tools can name the same package differently, which the study found affects attestations and provenance, so verifiers match provenance to package names with care (Tamanna et al., 2024, UR.1).

Identifier and Mapping Information

Section titled “Identifier and Mapping Information”

Schema Source

Section titled “Schema Source”

Mappings

Section titled “Mappings”
Mapping Type Mapped Value
self slsa:ecosystem
native slsa:ecosystem

LinkML Source

Section titled “LinkML Source”
name: ecosystem
description: The package ecosystem whose rules govern how a package is named and distributed,
  such as PyPA, npm or OCI.
comments:
- One ecosystem's tools can name the same package differently, which the study found
  affects attestations and provenance, so verifiers match provenance to package names
  with care (Tamanna et al., 2024, UR.1).
in_subset:
- slsa_build_track
- slsa_dependency_track
from_schema: https://w3id.org/lmodel/slsa
rank: 1000
slot_uri: slsa:ecosystem
domain_of:
- SlsaPackageRegistry
- SlsaPackage
range: string