invocation.configSource.uri does not conform to SLSA schema
Open
Nobody has claimed this yet.
kind/bug
- Dominant language
- Go
- Stars
- 277
- Forks
- 164
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 61
Description
Expected Behavior
According to its schema, the attribute invocation.configSource.uri of a v0.2 SLSA Provenance is expected to be an URI, e.g. , e.g.: oci://quay.io/<org>/<repo>
Actual Behavior
In 0.17.0, the invocation.configSource.uri attribute does not conform to an URI schema, e.g.: quay.io/<org>/<repo>.
This is similar to the issue fixed in https://github.com/tektoncd/chains/pull/792.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Compare the URI handling with the change in pull request 792, then locate where invocation.configSource.uri is generated for v0.2 SLSA Provenance. Verify the result against the linked SLSA schema; done means the value includes a valid URI scheme such as oci://.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100