You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<td>An immutable blob of data; primarily refers to software, but SLSA can be used for any artifact
122
-
<td>A file, a git commit, a directory of files (serialized in some way), a container image, a firmware image.
123
-
</tr>
124
-
<tr>
125
-
<th>Source
126
-
<td>Artifact that was directly authored or reviewed by persons, without modification. It is the beginning of the supply chain; we do not trace the provenance back any further.
127
-
<td>Git commit (source) hosted on GitHub (platform).
128
-
</tr>
129
-
<tr>
130
-
<th>Build
131
-
<td>Process that transforms a set of input artifacts into a set of output artifacts. The inputs may be sources, dependencies, or ephemeral build outputs.
132
-
<td>.travis.yml (process) run by Travis CI (platform).
133
-
</tr>
134
-
<tr>
135
-
<th>Package
136
-
<td>Artifact that is "published" for use by others. In the model, it is
137
-
always the output of a build process, though that build process can be a
138
-
no-op.
139
-
<td>Docker image (package) distributed on DockerHub (platform).
140
-
</tr>
141
-
<tr>
142
-
<th>Dependency
143
-
<td>Artifact that is an input to a build process but that is not a source. In
144
-
the model, it is always a package.
145
-
<td>Alpine package (package) distributed on Alpine Linux (platform).
146
-
</tr>
147
-
</tbody>
148
-
</table>
110
+
| Term | Description | Example |
111
+
|------|-------------|---------|
112
+
| Artifact | An immutable blob of data; primarily refers to software, but SLSA can be used for any artifact. | A file, a git commit, a directory of files (serialized in some way), a container image, a firmware image. |
113
+
| Source | Artifact that was directly authored or reviewed by persons, without modification. It is the beginning of the supply chain; we do not trace the provenance back any further. | Git commit (source) hosted on GitHub (platform). |
114
+
| Build | Process that transforms a set of input artifacts into a set of output artifacts. The inputs may be sources, dependencies, or ephemeral build outputs. | .travis.yml (process) run by Travis CI (platform). |
115
+
| Package | Artifact that is "published" for use by others. In the model, it is always the output of a build process, though that build process can be a no-op. | Docker image (package) distributed on DockerHub (platform). |
116
+
| Dependency | Artifact that is an input to a build process but that is not a source. In the model, it is always a package. | Alpine package (package) distributed on Alpine Linux (platform). |
0 commit comments