Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove the default JSON output #156

Closed
laurentsimon opened this issue Jul 21, 2022 · 2 comments · Fixed by #160
Closed

Remove the default JSON output #156

laurentsimon opened this issue Jul 21, 2022 · 2 comments · Fixed by #160

Comments

@laurentsimon
Copy link
Contributor

laurentsimon commented Jul 21, 2022

We output the following by default:

{
	"caller": "slsa-framework/slsa-verifier",
	"commit": "5875b0a74f4c04e1f123a3ad81d6c7c5a86860ce",
	"job_workflow_ref": "/slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@refs/tags/v1.1.1",
	"trigger": "push",
	"issuer": "https://token.actions.githubusercontent.com"
}

Should we convert this to non-JSON logs or remove entirely?

@SantiagoTorres mentioned offline this is confusing because it's not intoto format.

I think we had this option at the beginning for testing purposes.

I know we expose intoto via the --print-provenance, but I'm wondering if the text above causes confusion and should be removed.

@ianlewis @asraa @joshuagl

Wdut?

@asraa
Copy link
Contributor

asraa commented Jul 21, 2022

I think we can remove it. The caller is identical to the source option provided in the CLI, so that's redundant. The issuer likewise holds little information. It may be good to see which builder was used, but that can be a stderr print line like "Verified build using builder XYZ at commit SHA`.

@laurentsimon
Copy link
Contributor Author

SGTM. All this information is in the --print-provenance; so I think what we propose Verified build using builder XYZ at commit SHA LGTM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants