Skip to content
GitLab
Menu
Projects
Groups
Snippets
/
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Sign in / Register
Toggle navigation
Menu
Open sidebar
Shawn Webb
Slsa
Commits
94319618
Commit
94319618
authored
Jun 10, 2021
by
Mark Lodato
Browse files
Minor clarifications of source-requirements
parent
749007ea
Changes
1
Hide whitespace changes
Inline
Side-by-side
source-requirements.md
View file @
94319618
...
...
@@ -37,7 +37,7 @@ A revision meets SLSA 1.5 if all of the following are true:
this particular, immutable revision. In git, this is the {repo URL +
branch/tag/ref + commit ID}.
Almost any
popular version control system meet
s
this requirement, such as git,
Most
popular version control system meet this requirement, such as git,
Mercurial, Subversion, or Perforce.
NOTE: This does NOT require that the code, uploader/reviewer identities, or
...
...
@@ -107,12 +107,11 @@ A revision meets SLSA 3 if all of the following are true:
Y, the platform understands that this is the same person and does
not consider the review requirement satisfied.
- **[Informed Review]** The reviewer is able and encouraged to make an
informed decision about what they're approving. For example, it is not
acceptable to only display "path X was updated from hash abcd to hash
1234" because the reviewer would not be able to differentiate between a
benign change and a malicious one. Instead, the reviewer should be
presented with a diff between the proposed revision and the previous
SLSA 3 revisions.
informed decision about what they're approving. The reviewer should be
presented with a full, meaningful content diff between the proposed
revision and the previously reviewed revision. For example, it is not
sufficient to just indicate that file changed without showing the
contents.
- **[Context-specific Approvals]** Approvals are for a specific context,
such as a repo + branch in git. Moving fully reviewed content from one
context to another still requires review. (Exact definition of "context"
...
...
Write
Preview
Supports
Markdown
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment