JSON Schemas for attestors with generation scripts

[ChaosInTheCRD]

No description provided.

[matglas]

@ChaosInTheCRD the idea is to have this schema be published into a readable form for https://witness.dev for example so people can understand what the data is they will get correct?

[ChaosInTheCRD]

@matglas that is correct! Probably would be helpful to expose these on the CLI as well. I need to circle back on this at some point and get it ready for merge 😄

[jkjell]

Looks good and very straight forward. 👍

Two things this made me think about when reviewing:

• How are nested attestors represented (i.e. GitHub/GitLab using the JWT attestor)?
• For the (near-term) future: How do we handle schema versioning?

There's a few things that broke from the VSA stuff (and it'll break again after the Link/SLSA stuff too 😅).

[ChaosInTheCRD]

* How are nested attestors represented (i.e. GitHub/GitLab using the JWT attestor)?

@jkjell good catch, it is represented like:

      "properties": {
        "jwt": {
          "$ref": "#/$defs/Attestor"
        },

so yeah, the nesting seems to be an issue. I'm not sure what the tm correct way of fixing this is (besides doing a version of what I did for the SLSA, Link and VSA attestors.

*For the (near-term) future: How do we handle schema versioning?

Ah, of course we handle versioning with predicate type, but this isn't included in the JSON schema...

[jkjell]

Everything looks good other than the material and product attestor generation. If those are resolved we'll be good to go. ✅

[ChaosInTheCRD]

* How are nested attestors represented (i.e. GitHub/GitLab using the JWT attestor)?

@jkjell good catch, it is represented like:

      "properties": {
        "jwt": {
          "$ref": "#/$defs/Attestor"
        },

so yeah, the nesting seems to be an issue. I'm not sure what the tm correct way of fixing this is (besides doing a version of what I did for the SLSA, Link and VSA attestors.

*For the (near-term) future: How do we handle schema versioning?

Ah, of course we handle versioning with predicate type, but this isn't included in the JSON schema...

@jkjell with respect to this, should I try and find a solution or do you think it's fine as is for now?

[jkjell]

should I try and find a solution or do you think it's fine as is for now?

It's good for now. This is WAY better than what we have now... i.e. the source code. 😂

[colek42]

This is a great step forward. Aligning with upstream using protos would be nice, but a lot more work