Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SLSA documentation #397

Merged
merged 10 commits into from
Feb 13, 2023
Merged

SLSA documentation #397

merged 10 commits into from
Feb 13, 2023

Conversation

zachyonash
Copy link
Contributor

This change adds documentation explaining how FRSCA is achieving various levels of SLSA compliance.

Ref #231

@pull-request-size pull-request-size bot added the size/L Large (100-499 lines of changes) label Feb 6, 2023
@bradbeck bradbeck mentioned this pull request Feb 6, 2023
Merged
@bradbeck
Copy link
Contributor

bradbeck commented Feb 7, 2023

To resolve the DCO check:

"To avoid having PRs blocked in the future, always include Signed-off-by: Author Name <[email protected]> in every commit message. You can also do this automatically by using the -s flag (i.e., git commit -s)."

@zachyonash zachyonash marked this pull request as ready for review February 7, 2023 18:51
@zachyonash zachyonash requested a review from a team as a code owner February 7, 2023 18:51
@bradbeck
Copy link
Contributor

bradbeck commented Feb 7, 2023 •
edited
Loading

make lint should be able to help you reproduce the linting errors locally.

Or you can use markdownlint in VS Code.

rgreinho
rgreinho reviewed Feb 7, 2023
View reviewed changes
Copy link
Member

@rgreinho rgreinho left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me 👍

I just had one small remark.

docs/content/docs/slsa/frsca-slsa.md Outdated

# SLSA 2 Requirements

1. Source - [Version controlled](https://slsa.dev/spec/v0.1/requirements#version-controlled) ✅*
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

At the end of this line, there is an asterisk, but it is not pointing to anything.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I placed an asterisk to just denote that it's something that the FRSCA examples cover, but it's ultimately up to the end user to ensure their source requirements are fulfilled. If it's confusing I'm happy to just take it off.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It makes sense once you explain it 😃 Maybe you could just mention that explanation at the bottom of the list (or wherever you think it would make sense)?

@rgreinho
Copy link
Member

rgreinho commented Feb 7, 2023

make lint should be able to help you reproduce the linting errors locally.

Or you can use markdownlint in VS Code.

or use make fmt-md :)

@pull-request-size pull-request-size bot added size/XXL Extra Extra Large (1000+ lines of changes) and removed size/L Large (100-499 lines of changes) labels Feb 8, 2023
rgreinho
rgreinho previously approved these changes Feb 8, 2023
View reviewed changes
Copy link
Member

@rgreinho rgreinho left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

@pull-request-size pull-request-size bot added size/L Large (100-499 lines of changes) and removed size/XXL Extra Extra Large (1000+ lines of changes) labels Feb 8, 2023
dependabot bot and others added 9 commits February 8, 2023 10:51
@dependabot @kodiakhq
Bump github/codeql-action from 2.1.38 to 2.1.39 (buildsec#392)
03cfe61 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.38 to 2.1.39.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@515828d...a34ca99)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>
Signed-off-by: ZYonash <[email protected]>
@bradbeck
Update git-clone sha256 (buildsec#394)
42f5841 
The git-clone task was updated in place. This PR updates the sha256 used by vendorme.

Signed-off-by: Brad Beck <[email protected]>

Signed-off-by: Brad Beck <[email protected]>
Signed-off-by: ZYonash <[email protected]>
SLSA documentation
01314e3 
This change adds documentation explaining how FRSCA is achieving various levels of SLSA compliance.

Ref buildsec#231

Signed-off-by: ZYonash <[email protected]>
@bradbeck
Workaround for git dubious ownership error (buildsec#398)
8a31778 
* Workaround for git dubious ownership error

Workaround for the following error in the docs workflow:

```
fatal: detected dubious ownership in repository at '/github/workspace'
To add an exception for this directory, call:

	git config --global --add safe.directory /github/workspace
```

Signed-off-by: Brad Beck <[email protected]>

* Try new version of shalzz/zola-deploy-action

Signed-off-by: Brad Beck <[email protected]>

---------

Signed-off-by: Brad Beck <[email protected]>
Signed-off-by: ZYonash <[email protected]>
@dependabot @kodiakhq
Bump github/codeql-action from 2.1.39 to 2.2.1 (buildsec#395)
e65191e 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.39 to 2.2.1.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@a34ca99...3ebbd71)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>
Signed-off-by: ZYonash <[email protected]>
This commit fixes some of the wording and styling of the docs, and sh…
d84c8c7 
…ould fix the build error.

Signed-off-by: ZYonash <[email protected]>
Fixed some linting issues.
e80fba5 
Signed-off-by: ZYonash <[email protected]>
Revert "Fixed some linting issues."
6d4c970 
This reverts commit d286ca1.

Signed-off-by: ZYonash <[email protected]>
Removed unwanted changes to this PR. Fixed linting issues.
d1530f1 
Signed-off-by: ZYonash <[email protected]>
rgreinho
rgreinho approved these changes Feb 8, 2023
View reviewed changes
Copy link
Member

@rgreinho rgreinho left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

sudo-bmitch
sudo-bmitch approved these changes Feb 13, 2023
View reviewed changes
Copy link
Contributor

@sudo-bmitch sudo-bmitch left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@kodiakhq kodiakhq bot merged commit 1fcfd66 into buildsec:main Feb 13, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@rgreinho rgreinho rgreinho approved these changes

@sudo-bmitch sudo-bmitch sudo-bmitch approved these changes

Assignees
No one assigned
Labels
size/L Large (100-499 lines of changes)
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@zachyonash @bradbeck @rgreinho @sudo-bmitch