Provenance v1: Add builder to the SLSA Provenance model

[MarkLodato]

In the provenance v1 spec, it would be nice to clarify how the diagram and particularly the "Build Process" relate to the builder. The description talks about builder but is not shown in the diagram. (Originally posted by @rbehjati in #582 (comment).)

I'm not sure how best to do this so I'm creating this issue to track ideas.

First, what exactly is the builder in the diagram? Is it a collection of multiple boxes (e.g. platform, build type, build cache, build process)? Is it just the platform? Does it not really map to the diagram?

Once we decide that, we can figure out how to represent it. For example, I tried adding dashed lines around a collection of boxes but that added too much clutter.

[MarkLodato]

Also add a legend:

• Green = trusted, does not require verification
• Orange = external
• Grey = logical, doesn't really exist
• Red = the build process itself, red because it's under the tenant's control

Probably need to update the intro text to better explain and account for this.

[MarkLodato]

I don't have any good idea on how to add it. I'm inclined to close as "won't fix". Any opinions?

[rbehjati]

First, what exactly is the builder in the diagram? Is it a collection of multiple boxes (e.g. platform, build type, build cache, build process)? Is it just the platform? Does it not really map to the diagram?

Yes. Indeed. From the description, it is not clear to me if there is a difference between the builder and the platform. The description says that builder.id identifies the platform. From this, is it correct to conclude that builder and the platform are essentially the same thing?

If so, perhaps we just need to clarify in the description that builder is short for build platform. Also we often talk about a trusted builder. Is it the same as the platform?

@asraa Any ideas?

[asraa]

If so, perhaps we just need to clarify in the description that builder is short for build platform. Also we often talk about a trusted builder. Is it the same as the platform?

I think it seems like this.

Doesn't the builder/platform provides the System Parameters? so it might be worth putting a dotted arrow saying -- provides -->.

[rbehjati]

That makes sense.

@MarkLodato I think clarifying what the builder is in "Provenance is an attestation that the builder produced the subject software artifacts through execution of the buildDefinition." will fix this problem. Since the sentence says that the attestation is partly about the builder it is important to be clear what the builder is.

[MarkLodato]

Doesn't the builder/platform provides the System Parameters? so it might be worth putting a dotted arrow saying -- provides -->.

I've tried this, but it makes the diagram much harder to follow due to the added visual noise. Although it's true, I think it's easier to understand without it.