Add builderDependencies

Signed-off-by: Mark Lodato <lodato@google.com>
slsa-framework · Nov 7, 2022 · f87271e · f87271e
1 parent b661ee1
commit f87271e
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 2 deletions.
diff --git a/docs/provenance/v1.0.cue b/docs/provenance/v1.0.cue
@@ -23,7 +23,8 @@
         "runDetails": {
             "builder": {
                 "id": string,
-                "version": string
+                "version": string,
+                "builderDependencies": [...#ArtifactReference]
             },
             "metadata": {
                 "invocationId": string,

diff --git a/docs/provenance/v1.0.md b/docs/provenance/v1.0.md
@@ -280,6 +280,7 @@ meaning of each field is unchanged unless otherwise noted.
         "builder": {
             "id": old.builder.id,
             "version": null  // not in v0.2
+            "builderDependencies": null // not in v0.2
         },
         "metadata": {
             "invocationId": old.metadata.buildInvocationId,
@@ -319,7 +320,7 @@ changed slightly.
     input artifacts to be specified.
 -   Moved `entryPoint` out of `buildConfig` so that all artifact references
     share a common schema.
--   Added `builder.version`.
+-   Added `builder.version` and `builder.builderDependencies`.
 -   Added `byproducts`.
 -   Removed `buildConfig`; can use `inputArtifacts.config` or `byproducts`
     instead.

diff --git a/docs/provenance/v1.0.proto b/docs/provenance/v1.0.proto
@@ -218,6 +218,12 @@ message Builder {
 
   // TODO: Do we want to add this field? (#319)
   string version = 2;
+
+  // Dependencies used by the orchestrator that are not run within the workload
+  // and that should not affect the build, but may affect the provenance
+  // generation or security guarantees.
+  // TODO: Flesh out this model more.
+  repeated ArtifactReference builderDependencies = 3;
 }
 
 message BuildMetadata {