Move Provenance to SLSA repo

[MarkLodato]

The current Provenance predicate is described as a generic way to express provenance, but it was designed expressly for SLSA. It makes certain assumptions and trade-offs, such as carefully designing the fields to avoid mistakes when applying a SLSA policy. Other use cases of "provenance" may make different trade-offs, such as including the list of build steps that were performed to allow policies to detect curl | bash, which for SLSA is unnecessary and may lead to confusion.

To avoid these issues, it might be best to move all of the predicates out of this repo and instead maintain an index of links.

• Provenance -> SLSA
• Link -> in-toto (a different repo)
• SPDX -> something maintained by SPDX team

That would make it more clear that (a) other definitions of "provenance" are OK for different use cases, and (b) not all predicates need to be defined in this repo.

Any thoughts? cc @adityasaky @TomHennen @dlorenc

[joshuagl]

Moving predicate definitions out of this repo makes sense to reinforce that this is the format definition and to encourage definition of use-case specific predicates.

Do you think there would need to be any categorisation or review of predicates we link to?

[MarkLodato]

Do you think there would need to be any categorisation or review of predicates we link to?

Perhaps eventually, if we get a lot of them. Initially I'm assuming there will only be a few.

[TomHennen]

This makes sense to me.

[adityasaky]

I think this makes sense. Should we emphasize a "list your predicate here" mechanism that incorporates review, and also discusses ongoing review for any possible changes made after a predicate is listed here?

[TomHennen]

I like that idea.

I guess it would take the form of some doc that gives a blub about the predicate and links to wherever it's actually defined. Is that what you're thinking?

Do we have agreement on this? If so I can move 'Provenance' to the SLSA repo and create an initial doc of predicates.

[adityasaky]

I think that makes sense, and we can formalize any review processes we feel is necessary when we have more predicates as @MarkLodato said.