Refine the definition of Artifact IDs

[afrittoli]

Build and artifact events today include an "artifact id".

This is identified as a unique identifier of an artifact.
There are open questions about which ID is available to which event though:

• when an artifact is built locally (i.e. not pushed yet), what is its ID? possibly the hash? Perhaps we could introduce an optional artifact hash for this?
• when an artifact is published, how do we link the events build, artifact packaged and artifact published events? Do we do that through the links in the event? That is a valid option, but it adds more requirements:
  1. the system doing the build and push must have a shared context (which is likely to be the case, but worth noting)
  2. the consumer must receive and store all relevant events
• is the artifact ID associated to the artifact type or the artifact storage system?

We should be more specific on what the artifact ID is to better guide implementors (event producers and consumers alike):

• identify well known types of artifacts (container images, jar files, python wheels, platform specific binaries, etc)
• identify vendor neutral storage types (OCI container registry, else?) and what the ID is for each

What extra standard data shall we include for artifact?

• optional rekor UUID
• optional signature
• optional hash

[afrittoli]

Using https://github.com/package-url/purl-spec is one option.
We could include purl or say that the artifact ID needs to have properties similar to those of a purl.
Specifically the artifact ID should not change when an artifact is published in different locations.

Build events should produce an artifact ID in this format.
Artifact packaged and published events should produce and artifact ID in this format.
Artifact published events should additionally include an artifact URL attribute.

[afrittoli]

There is value in enforcing the type for consumers to parse the artifact ID - not having one format harms interoperability.

• Set this as a required field
• Reach out to the purl community
• Update the SDK (follow up)

[afrittoli]

Security related aspects of artifact ID will be covered in #70