Add 'profiles' for the Source Track

[TomHennen]

@adityasaky suggested that it might make the source track more clear if we

1. Define 'profiles' for source control systems as a combination of VCS, SCP, attestation issuers, etc...
2. Each profile should explain how it would meet the various source level requirements
3. Remove many of the examples that are currently inlined with the requirements themselves

@adityasaky mentions this would be made easier once we define a source control system #1128 .

[TomHennen]

This is probably a good way to address @marcelamelara's comment here #1128 (comment)

[TomHennen]

I'm wondering if we think this is a blocker for releasing the source track. It seems like a good amount of work that we haven't made much progress on. I also think that perhaps it's not required right now? (Or we can address it in another point release)

[adityasaky]

I think this really applies for presenting different ways of adopting the source track. I guess the question is if we expect to cut a release that includes the source track even if there aren't 1+ ways people can adopt it? (i.e., integrations into github, changes needed in gittuf for attestation pieces, etc.)

[TomHennen]

I know some folks (myself included) were hoping to get source track out the door soon. Since we haven't had any work done on profiles, I don't see how we can get both things (e.g. release soon with profiles).

Right now I don't think there's anything that limits source track adoption to just one way, it's more that we don't have any specific documented ways to adopt it.

Perhaps we can:

1. Release without profiles.
2. Start implementing some methods of achieving it.
3. Document those methods as 'profiles'?
4. Cut a new release?

[adityasaky]

I think not blocking on this is fine. I also wonder if this is really a cross-slsa issue rather than limited to the source track. We could use this idea to communicate "known ways" to implement any SLSA track. Eg: using github-attest-provenance in gha is an example for the build track.

[marcelamelara]

How much more work is needed to define "profiles"? My interpretation of most of the early feedback on this topic was more related to clearly defining the roles and SCS model, which the Source track has already largely done.

EDIT: So I agree that we don't need to block on this for the initial release of the Source track.

[adityasaky]

My interpretation of most of the early feedback on this topic was more related to clearly defining the roles and SCS model, which the Source track has already largely done.

In my view, this proposal was related to clearly defining the roles and SCS model in the spec itself but went further in that a profile would say specifically which system is responsible for a particular role. So, you could imagine a GitHub + Scorecard profile, a gittuf profile, etc. for the source track.

I still think this may be a cross-SLSA proposal, perhaps even related to some of the recent discussions around communicating conformance with the SLSA spec?