protos

Protocol buffer definitions for the SLSA attestation predicates.

Layout

Each predicate lives at proto/<track>/<version>/predicate.proto. The Go packages are generated at the repo root, so the import paths are github.com/slsa-framework/protos/<track>/<version>:

Predicate	Type URI	Proto	Go import path
Build provenance v1	https://slsa.dev/provenance/v1	proto/build/v1/predicate.proto	github.com/slsa-framework/protos/build/v1
Build provenance v0.2	https://slsa.dev/provenance/v0.2	proto/build/v02/predicate.proto	github.com/slsa-framework/protos/build/v02
Verification summary (VSA) v1	https://slsa.dev/verification_summary/v1	proto/vsa/v1/predicate.proto	github.com/slsa-framework/protos/vsa/v1
Source provenance v1	source track (source-tool)	proto/sourcetool/v1/predicate.proto	github.com/slsa-framework/protos/sourcetool/v1

The build and VSA predicates were migrated from in-toto/attestation via slsa-core, and the source predicate from slsa-framework/source-tool. Message and field definitions are unchanged, so the wire and JSON forms remain compatible.

The predicates reference in-toto elements where the spec does (e.g. ResourceDescriptor). Nothing is vendored: make proto-deps fetches the upstream in-toto protos out of the go.mod-pinned in-toto/attestation Go module into the gitignored third_party/ directory, where buf resolves the imports. The in-toto protos are never generated here — the generated Go uses the upstream types from github.com/in-toto/attestation/go/v1, so the proto sources and the Go types always come from the same upstream version.

Working with the protos

make tools     # install the pinned protoc-gen-go
make lint      # buf lint (fetches the in-toto protos first)
make generate  # regenerate the Go packages (fetches the in-toto protos first)
make tidy      # sync go.mod/go.sum