Need better clarity on bundle filename for chains of attestations

[MarkLodato]

The current bundle file naming convention is misleading for the case when the bundle is a set of dependent attestations that are all "about" a single artifact but have different subjects. Current wording:

• Bundles that concern a single artifact SHOULD name the bundle file <artifact filename>.intoto.jsonl.
• Bundles that concern multiple artifacts SHOULD name the bundle file multiple.intoto.jsonl.

The phrase "concern a single artifact" needs more specificity. It could be read two ways:

• (unintended) If any of the attestations in the bundle have a subject other than <artifact>, name it multiple.intoto.jsonl.
• (intended) If the set of attestations are intended to verify a single artifact, regardless of the attestations' subject, name it <artifact filename>.intoto.jsonl.

cc: @shaunmlowry @TomHennen @mlieberman85

[TomHennen]

Yes, agreed.

(intended) If the set of attestations are intended to verify a single artifact, regardless of the attestations' subject, name it .intoto.jsonl.

I wonder if this should cover "attestations produced during the artifact's SDLC"?

[mlieberman85]

Here's how I see it potentially playing out. I am OK with duplicating an attestation across for multiple artifacts if that one attestation has multiple subjects. Since we have jsonl we can do stuff like:

Attestation A refers to Artifact 1 and Artifact 2.
Attestation B refers only to Artifact 1.
Attestation C refers only to Artifact 2.

artifact1.jsonl can contain Attestation A and Attestation B.
artifact2.jsonl can contain Attestation A and Attestation C.

Just want to clarify there that however we word it, it should support the above use case.

[TomHennen]

I agree with that.

I think it would also be fine if artifact1.jsonl contained Attestation A, B, and C.

I.e. it's fine (but not optimal) if the bundle contains attestations that aren't applicable.

[laurentsimon]

feedback from sigstore/sigstore-python#223 (comment): need the version number in the filename, multiple-v1.2.3.intoto.jsonl. /cc @diogoteles08

[MarkLodato]

Please see #115 for a potential fix.