Skip to content
Snippets Groups Projects
Unverified Commit f314ee96 authored by John Speed Meyers's avatar John Speed Meyers Committed by GitHub
Browse files

Add intoto type documentation (#679)


* Add in-toto type documentation

Signed-off-by: default avatarJohn Speed Meyers <jsmeyers@chainguard.dev>
parent 88e91b94
No related branches found
No related tags found
No related merge requests found
**in-toto Type Data Documentation**
This document provides a definition for each field that is not otherwise described in the [in-toto schema](https://github.com/sigstore/rekor/blob/main/pkg/types/intoto/v0.0.1/intoto_v0_0_1_schema.json). This document also notes any additional information about the values associated with each field such as the format in which the data is stored and any necessary transformations.
**Attestation:** authenticated, machine-readable metadata about one or more software artifacts. [SLSA definiton](https://github.com/slsa-framework/slsa/blob/main/controls/attestations.md)
- The Attestation value ought to be a Base64-encoded JSON object.
- The [in-toto Attestation specification](https://github.com/in-toto/attestation/blob/main/spec/README.md#statement) provides detailed guidance on understanding and parsing this JSON object.
**AttestationType:** Identifies the type of attestation being made, such as a provenance attestation or a vulnerability scan attestation. AttestationType's value, even when prefixed with an http, is not necessarily a working URL.
**How do you identify an object as an in-toto object?**
The "Body" field will include an "IntotoObj" field.
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment