Core Attestation Framework Spec Changes

• Ensure the Envelope spec meets ITE-5 by @marcelamelara in #431
• Add predicate type to the allowed media types for the envelope's payload type by @mdeicas in #473
• Clarify that non-cryptographic digests may use custom value encoding by @marcelamelara in #517

New / Updated Predicates

• New Simple Verification Result (SVR) Predicate by @arewm in #470
• Update Release Predicate to v0.2 by @ bdehamer in #495
• New SPDX 3 Predicate by @JPEWdev in #508

Language Bindings Changes

• Support validation of Cosign OCI statements with type https://in-toto.io/Statement/v0.1 by @alenon in #464
• Add Rust bindings by @marcelamelara in #468
• SVR proto definitions by @puerco in #519

Other Changes

• Update link to URL redirects list by @mdeicas in #471
• docs: fix typo in README.md by @tarilabs in #472
• Upgrade Go in make-protos.yml@setup-go to be consistent w/ go.mod by @trishankatdatadog in #488
• Bump Go version in CI tests by @marcelamelara in #491
• Update attestation maintainers by @marcelamelara in #516 and #536
• Add SVR to the list of predicates and fix some issues in the list by @lcarva in #537

New Contributors

• @tarilabs made their first contribution in #472
• @alenon made their first contribution in #464
• @bdehamer made their first contribution in #495
• @JPEWdev made their first contribution in #508
• @lcarva made their first contribution in #537

Full Changelog: v1.1.2...v1.2.0

What's Changed

• Bump markdownlint-cli from 0.43.0 to 0.44.0 by @dependabot in #439
• Bump actions/setup-go from 5.2.0 to 5.3.0 by @dependabot in #438
• Bump google.golang.org/protobuf from 1.36.3 to 1.36.4 by @dependabot in #437
• Regenerate attestation libraries by @github-actions in #440
• Bump peter-evans/create-pull-request from 7.0.6 to 7.0.7 by @dependabot in #444
• Bump google.golang.org/protobuf from 1.36.4 to 1.36.5 by @dependabot in #442
• Bump actions/setup-node from 4.1.0 to 4.2.0 by @dependabot in #441
• Regenerate attestation libraries by @github-actions in #445
• Bump google.golang.org/protobuf from 1.36.5 to 1.36.6 by @dependabot in #451
• Bump actions/setup-node from 4.2.0 to 4.3.0 by @dependabot in #450
• Bump actions/setup-go from 5.3.0 to 5.4.0 by @dependabot in #449
• add slsa provenance predicate v0.1 v0.2 by @kpauljoseph in #448
• Bump peter-evans/create-pull-request from 7.0.7 to 7.0.8 by @dependabot in #446
• update go to v1.22 to fix parsing issues by @pxp928 in #453
• update workflow to use updated version of go by @pxp928 in #454
• Regenerate attestation libraries by @github-actions in #455
• fix typo in docstring by @indiVar0508 in #443
• Bump brace-expansion from 2.0.1 to 2.0.2 by @dependabot in #467

New Contributors

• @indiVar0508 made their first contribution in #443

Full Changelog: v1.1.1...v1.1.2

What's Changed

• Fix broken links to ResourceDescriptor by @alanssitis in #367
• Update link to SLSA framework proto file by @phantomwhale in #382
• Simplify SCAI predicate TypeURI by @marcelamelara in #380
• Add the reference predicate by @mdeicas in #375
• Add proto definition for vuln predicate type by @hectorj2f in #345
• vsa: Make verifiedLevels field repeated to match spec by @adityasaky in #429
• fix discrepencies in v0.2 example by @lumjjb in #408
• VulnsV2: Add missing invocation to protos and spec by @puerco in #434
• Expose known algorithms by @puerco in #427
• add slsa provenance predicate v0.2 protobuf by @kpauljoseph in #417

New Contributors

• @tannerjones4075 made their first contribution in #366
• @alanssitis made their first contribution in #367
• @phantomwhale made their first contribution in #382
• @mdeicas made their first contribution in #375
• @Dman0808 made their first contribution in #394
• @lumjjb made their first contribution in #408
• @puerco made their first contribution in #434
• @kpauljoseph made their first contribution in #417

Full Changelog: v1.1.0...v1.1.1

The v1.1.0 minor release generalizes the semantics of the DigestSet field type to support any type of immutable identifier. This change is backwards compatible because cryptographic digests are strongly recommended to achieve immutability, so any implementations that only support cryptographic DigestSet still meet the modified semantics. The _type of a Statement is still https://in-toto.io/Statement/v1

More details in the updated DigestSet spec

This patch release includes a new predicate type, updates to the predicate vetting process, and more thorough DigestSet validation in Go.

Go, Python and Java APIs are not considered stable before v1.1.

What's Changed

• Add Release Attestation by @steiza in #319
• Add common action items for the new predicate vetting process by @marcelamelara in #320
• Add ITE-9 predicate template by @adityasaky in #328
• Add DigestSet hex encoding validation by @marcelamelara in #330

New Contributors

• @steiza made their first contribution in #319

Full Changelog: v1.0.1...v1.0.2

This patch release includes on documentation, predicate spec and Go and Python API changes. This release also introduces new vetted predicates. Go, Python and Java APIs are not considered stable before v1.1.

What's Changed

• Update documentation: Add graphic to visualize relationships between layers by @dasiths in #166
• Add predicate specification for CycloneDX by @danbev in #129
• Remove extension fields from versioning.md by @TomHennen in #169
• Add predicate capturing results of test runs by @adityasaky in #152
• Move protos to their own directory for more consistency between different language bindings by @marcelamelara in #180
• Update SPDX predicate specification by @danbev in #187
• Update SCAI predicate to v0.2 by @marcelamelara in #170
• Link to existing predicates from predicate.md by @arewm in #195
• Autogenerate attestation libraries using protoc by @adityasaky in #192
• Update provenance.md to v1 by @trishankatdatadog in #197
• Add python bindings for protobufs by @chasen-bettinger in #172
• Enable python packaging by @adityasaky in #201
• Fix VSA dir structure and package name by @adityasaky in #204
• Add python bindings to docs by @marcelamelara in #202
• Add Java bindings by @adityasaky in #205
• Add link to SLSA/in-toto blog post by @adityasaky in #213
• Allow uses of ResourceDescriptor to require fields by @adityasaky in #211
• Use only major version for spec docs by @adityasaky in #214
• Define v0.3 of the link predicate by @adityasaky in #203
• Add governance doc by @adityasaky in #218
• Use ResourceDescriptor for statement subjects by @adityasaky in #212
• Minor typo and other fixes to SCAI predicate spec by @marcelamelara in #215
• Update Joshua's affiliation by @joshuagl in #221
• Require 'subject[*].name' to be unique for links by @adityasaky in #223
• Add Golang wrapper APIs and tests by @marcelamelara in #220
• Add proto for test result predicate by @adityasaky in #233
• Update the SLSA provenance predicate to v1 by @marcelamelara in #222
• Update supported protoc version in CI by @marcelamelara in #243
• Add SCAI predicate protobuf definition by @marcelamelara in #235
• Change annotations fields in ResourceDecriptor from objects to values by @joshuagl in #251
• fix(tests): fix go tests since #251 by @joshuagl in #259
• add missing trigger for push main branch in go-test workflow by @pxp928 in #260
• Use lower_camel_case consistently for fields in protobuf definitions by @joshuagl in #257
• Define annotations field type in ResourceDescriptor proto as Struct by @marcelamelara in #263
• Update Go tests by @adityasaky in #267
• Add Python validation APIs and unit tests by @marcelamelara in #227
• Add Go and Python bindings for SCAI predicate by @marcelamelara in #272
• vulnerability attestation: ITE-9 specification by @hectorj2f in #268
• Update vsa.md by @trishankatdatadog in #288
• Clarify specification on Bundle and Envelope media types by @marcelamelara in #283
• Add Go validator APIs for Provenance v1 predicate by @marcelamelara in #287
• in_toto_attestation/v1: fix type hints by @woodruffw in #301
• update vsa proto to v1 and update generated code by @pxp928 in #302
• Prepare python release v0.9.3 by @adityasaky in #310
• Python in CI/CD, add lintage and tests by @woodruffw in #306
• python: drop Python 3.7, run pyupgrade + isort rules by @woodruffw in #312
• update make-protos workflow to use newer version of protoc by @pxp928 in #309

New Contributors

• @dasiths made their first contribution in #166
• @danbev made their first contribution in #129
• @arewm made their first contribution in #195
• @trishankatdatadog made their first contribution in #197
• @chasen-bettinger made their first contribution in #172
• @hectorj2f made their first contribution in #268
• @woodruffw made their first contribution in #301

Full Changelog: v1.0...v1.0.1

v1.0 Release

Our first major release introduces new primitives, basic tooling and guidelines for contributing new predicates types. We also made significant updates to the DigestSet type and extension fields.

What's New

• Guidelines for contributing new predicates
• Attestation Bundle layer: A collection of multiple attestations in a single file.
• Resource Descriptor type: A size-efficient description of any software artifact or resource (mutable or immutable).
• Protobuf definitions: Language-independent definitions of attestation Statement and select predicates.
• Golang library and example app

DISCLAIMER: The protobuf definitions and Golang bindings will not be considered stable until the v1.1 tagged release. Use at your own risk.

Updates

• Add dirHash1, gitCommit, gitTree, etc. to the list of pre-defined algorithms for DigestSet
• Specify lowercase-hex encoding for standard algorithms only
• Relax requirements for Statement subject name
• Updated rules for extension fields and unrecognized fields
• Documentation updates

New Predicate Types

Since v0.1, we have added three predicate types to our catalog. Please note that predicates are versioned independently from the in-toto attestation spec.

• Supply Chain Attribute Integrity (SCAI): Evidence-based assertions about software artifact and supply chain attributes or behavior.
• Runtime Traces: Captures runtime traces of software supply chain operations.
• SLSA Verification Summary (VSA): SLSA verification decision about a software artifact.

Thanks

Thank you to all contributors to this release!

Full Changelog: v0.1.0...v1.0