feat: Add externalParameters.source for v1 specs for BYOB

[laurentsimon]

closes #2186

[laurentsimon]

this check should have been failing. The daily runs were not working due to permission errors https://github.com/slsa-framework/slsa-github-generator/actions/runs/5125842921
I've tried addressing this in this PR by changing the default perms to permissions: {} in the workflows

[ianlewis]

We had a discussion about adding an identifier for the source repo to the annotations field in resolvedDependencies? What do you think about that idea?

I think @asraa had it on her PR slsa-framework/slsa-verifier#621 but removed it.

[asraa]

We had a discussion about adding an identifier for the source repo to the annotations field in resolvedDependencies?

I think if we do, it'd be great to have a universal annotation that's agreed upon between multiple builders, so that parsing the arbitrary object can be shared logic.

Since annotations are maps of strings to objects, maybe it can be usage: <some-source-type-uri>?

[ianlewis]

I think if we do, it'd be great to have a universal annotation that's agreed upon between multiple builders, so that parsing the arbitrary object can be shared logic.

Yeah, I agree. It should probably get into the https://github.com/slsa-framework/github-actions-buildtypes repo at the very least.

Since annotations are maps of strings to objects, maybe it can be usage: <some-source-type-uri>?

For reference, Kubernetes has a similar type of annotations (though string: string) and they use URIs in the keys with "official" annotations using a kubernetes.io domain.
https://kubernetes.io/docs/reference/labels-annotations-taints/

Maybe SLSA needs a few of these well known annotations.

[laurentsimon]

Maybe SLSA needs a few of these well known annotations.

I'm curious what's the point of these annotation in practice. iiuc, the verification is only required to look at externalParameters.source, and anything in material is to do recursive verification of dependencies... so do we get anything by adding annotations today? I think working with SLSA specs to figure what those annotations are is a good idea since there may be many corner cases... ingestion of a package dep (e.g., npm), etc.. but I wonder if you may be able to verify recursively just using the uri / purl.

[laurentsimon]

There is WIP for specs to resolve this, so closing for now