feat: add v1?draft slsa provenance definition

[asraa]

Signed-off-by: Asra Ali asraa@google.com

Fixes issue:
Related #197

Description:
Implements the v1?draft SLSA provenance spec. I expect it will be complete by end of the month, and don't think there will be too many changes. I can keep the issue open to migrate the URI to v1 (removing the draft) with whatever remaining format changes there are in the follow-up.

Please verify and check that the pull request fulfills the following
requirements:

• [ x ] Tests have been added for the bug fix or new feature
• [ x ] Docs have been added for the bug fix or new feature: added docstrings

[pxp928]

LGTM! We can keep the issue open and change it to remove draft once finalized.

[adityasaky]

I'd prefer to leave it open as a draft to avoid someone accidentally using a non tagged version. @asraa wdyt?

[asraa]

I'd prefer to leave it open as a draft to avoid someone accidentally using a non tagged version. @asraa wdyt?

Right now the format is in v1?draft URI, so I do think people will be aware that the provenance is subject to change.

The reason I'd like it (even if pushed to a branch?) is that it blocks us from drafting tooling until the spec goes GA, where it would be nice to be developing alpha tooling while it still is to test its use-ability. WDYT about the branch idea?

[adityasaky]

Gotcha, let me review the status of next.

[pxp928]

I'd prefer to leave it open as a draft to avoid someone accidentally using a non tagged version. @asraa wdyt?

Right now the format is in v1?draft URI, so I do think people will be aware that the provenance is subject to change.

The reason I'd like it (even if pushed to a branch?) is that it blocks us from drafting tooling until the spec goes GA, where it would be nice to be developing alpha tooling while it still is to test its use-ability. WDYT about the branch idea?

I agree. Would be useful to start updating tools to meet the spec.

[adityasaky]

Done! Thanks @asraa!

[asraa]

Thank you all! I appreciate having a basis :)
I will definitely be on top of any spec updates, so that's my contract for this.