Document how SLSA levels are met by example pipelines

[pxp928]

Current Behavior

With multiple example pipelines that exist today in FRSCA, there is no mapping on how they are meeting the various SLSA levels.

Expected Behavior

Document how the pipelines with the various tools and controls are meeting the SLSA levels. Which conditions are being met within each level and which are still missing.

[cdwbrad]

I'd also be very interested in seeing this kind of documentation. I was reading this Google blog post that implies that self-hosted GitHub action runners can't achieve the build isolation required for SLSA 3+.

My thought was that using SPIFFE/SPIRE for node & workload verification would possibly be sufficient(?). But that's just one example where mapping SLSA in some of the examples would be helpful.

[mlieberman85]

This was also just discussed at the SLSA meeting today on June 9th, 2022. It would be useful to make sure to folks that it's clear how Frsca meets the various SLSA requirements and having also examples.

@cdwbrad SPIFFE/Spire should meet the requirements and the work I believe is mostly done to integrate Spire into Tekton Chains which would allow Frsca to achieve that higher level requirement.

[cdwbrad]

@mlieberman85 That's good to hear. Where are the SLSA meetings (incl. schedule & notes) tracked?

[anniepamela2020]

@cdwbrad https://github.com/slsa-framework/slsa