SLSA Level 1 compliance for Istio Release Process

[kfaseela]

Describe the feature request

SLSA is a security framework, a check-list of standards and controls to prevent tampering, improve integrity, and secure packages and infrastructure in your projects, businesses or enterprises. The objective of this issue is to track the progress of Istio Release Process to achieve SLSA Level 1 compliance. While most of the things seem to be already in place for Level 1 compliance, what is missing is a provenance attestation.

https://github.com/kubernetes-sigs/tejolote seems to be coming up with a provenance attestation framework which is soon going to support prow as well. It would be a good choice to add the attestation for Istio.

The compliance checklist for SLSA for Istio is tracked here.

Affected product area (please put an X in all that apply)

[ ] Ambient
[ ] Docs
[ ] Installation
[ ] Networking
[ ] Performance and Scalability
[ ] Extensions and Telemetry
[ ] Security
[X] Test and Release
[ ] User Experience
[ ] Developer Infrastructure

[kfaseela]

cc @ericvn @howardjohn

[puerco]

/cc

[kfaseela]

@puerco let us know once the prow support is in place for tejolote. Another option is https://github.com/testifysec/witness , have you explored?

[kfaseela]

cc @fkautz

[kfaseela]

knative/test-infra#3748 seems to be a good start for us, as this has prow integration. I will try this out and see how it goes

[kfaseela]

Looks like SLSA checklist has been updated: https://slsa.dev/spec/v1.0/whats-new

[kfaseela]

/not stale