Move source track VSA info to the VSA spec?

[TomHennen]

Eventually, I think this list should be moved closer to the VSA spec itself so that users can reference the schema and these specific requirements together.

Originally posted by @marcelamelara in #1094 (comment)

[zachariahcox]

@TomHennen is there much work left to do here?

I think the goal is to say:

SLSA has two main phases: data production and policy evaluation. 

Provenance attestations are data production. 
They are generated by authoritative sources, sources responsible for overseeing the claims to which they attest. 

"VSAs" are policy evaluations. 
A policy can be evaluated against the tamper-resistant provenance attestations to produce a policy decision. 
The organization uses VSAs to determine whether a specific artifact, package, repository revision is suitable for the next phase of the SDLC.

[TomHennen]

@TomHennen is there much work left to do here?

I think the idea in this issue is to move the parts of source-requirements that talk about how to populate a VSA out of source-requirements.md and move them to https://slsa.dev/spec/draft/verification_summary.

So it's just moving content. I'm not sure if I like that idea (haven't thought about it much), but I wanted to capture @marcelamelara's request from another PR.

Regarding your suggestion, yes that makes sense, though it does miss that VSAs are also intended to be used outside the organization. However, that might be tracked better in a separate issue or PR?

[TomHennen]

We can probably also have a spot for other SLSA tracks to indicate what properties they cover and how VSAs should refer to the various types of things (source revisions, artifacts, build environments...). See #1115 (comment) for context

[TomHennen]

I'd like to put this off until 1.1 is released. Otherwise it's just going to be more difficult for @lehors to produce the 1.1 version.

[lehors]

Yes, please! Thanks @TomHennen.

[TomHennen]

Based on the discussion in this week's meeting it sounds like we're leaning towards trying to keep new tracks as self-contained as possible (at least for now). With that in mind I wonder if we can close this issue?

Keeping how to use the VSA for the source track in the source track page would seem to be in keeping with that approach?

[marcelamelara]

Keeping how to use the VSA for the source track in the source track page would seem to be in keeping with that approach?

I personally worry that too much fragmentation will be confusing for spec users, but I also don't yet have a clear sense of where the right balance is. So I'm ok with deferring this for v1.1, though I do think that we'll eventually want to move towards a generalized VSA spec, which seems like a better occasion to revisit my original comment.