Tracking issue for draft SLSA 1.0 support in tools

[mlieberman85]

This is just a tracking issue (of tracking issues) so we can list the tools out there that are supporting SLSA today, or planning support SLSA, and plan to support the draft 1.0 spec.

There are 2 goals:

1. Show demonstrative examples of the draft 1.0 spec or requirements conformance in action.
2. Help us test out the draft 1.0 spec and provide feedback

List (will be edited as time goes on)

• GitHub Generator - [feature][tracking] - SLSA 1.0 support slsa-github-generator#1734
• Verifier - [tracking] SLSA 1.0 tracking issue slsa-verifier#515
• FRSCA
• Tekton - Support SLSA 1.0 provenance spec tektoncd/chains#728
• Npm cli - Tracking issue for SLSA v1.0 provenance npm/cli#6268
• Buildkit - SLSA 1.0 Spec support moby/buildkit#3684
• PyPI - ??
• Sigstore Cosign - Add support for SLSA 1.0 predicate sigstore/cosign#2860
• in-toto golang - Support v1.0 SLSA provenance format in-toto/in-toto-golang#197
• Witness - SLSA Provenance Attestation in-toto/witness#217

[colek42]

We are planning to support SLSA in witness soon. in-toto/witness#217

[pxp928]

GUAC is being updated to support multiple versions of SLSA: guacsec/guac#793

[bobcatfish]

I'm excited to say that are planning to add support for SLSA 1.0 to Google Cloud Build as well! 🥳 plz add us to the list 🙏

[marcelamelara]

Pinging this issue since I've been looking at buildkit provenance generation recently, they still only support v0.2. Seems like their main blockers for implementing v1 are explained in #716. Might want to have a discussion on how we might approach this issue.