Blog post for slsa-github-generator generic GA

[ianlewis]

Adds a blog post about the slsa-github-generator generic workflow and
it's general availability. This is a follow on to the previous blog post
on slsa-github-generator's Go functionality published on Jun 20.

Signed-off-by: Ian Lewis <ianlewis@google.com>

[netlify]

✅ Deploy Preview for slsa ready!

Name	Link
🔨 Latest commit	4a3e535
🔍 Latest deploy log	https://app.netlify.com/sites/slsa/deploys/630d5135adf0080008ae3154
😎 Deploy Preview	https://deploy-preview-471--slsa.netlify.app/blog/2022/08/slsa-github-workflows-generic-ga
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site settings.

[laurentsimon]

Thanks!

[mlieberman85]

LGTM

[laurentsimon]

@MarkLodato is OOO. Any additional feedback? @joshuagl @kimsterv?

[ianlewis]

Also would like approval from @asraa as well as her name is in the author line.

[laurentsimon]

Thanks everyone for the thorough reviews. Any further comments before we can merge this PR?

[varunsh-coder]

Thanks everyone for the thorough reviews. Any further comments before we can merge this PR?

Do you want to mention the recent pypi phishing and related unauthorized publishing of packages in the examples? Just a suggestion. no other comments from my side.

[laurentsimon]

Thanks everyone for the thorough reviews. Any further comments before we can merge this PR?

Do you want to mention the recent pypi phishing and related unauthorized publishing of packages in the examples? Just a suggestion. no other comments from my side.

We already have examples in the text, but we can add one more. Do you have a link in mind you think we should add?

[varunsh-coder]

Thanks everyone for the thorough reviews. Any further comments before we can merge this PR?

Do you want to mention the recent pypi phishing and related unauthorized publishing of packages in the examples? Just a suggestion. no other comments from my side.

We already have examples in the text, but we can add one more. Do you have a link in mind you think we should add?

This one https://www.bleepingcomputer.com/news/security/pypi-packages-hijacked-after-developers-fall-for-phishing-emails/? I know there are already examples, which is why this might not be needed. At the same time, this is more recent and top of mind.

[inferno-chromium]

Thank you @mlieberman85 for your review. I think this only needs one reviewer, but leaving for any other final comments from steering committee for another day (it was shared earlier in the week).

[ianlewis]

Thanks everyone for the thorough reviews. Any further comments before we can merge this PR?

Do you want to mention the recent pypi phishing and related unauthorized publishing of packages in the examples? Just a suggestion. no other comments from my side.

We already have examples in the text, but we can add one more. Do you have a link in mind you think we should add?

This one https://www.bleepingcomputer.com/news/security/pypi-packages-hijacked-after-developers-fall-for-phishing-emails/? I know there are already examples, which is why this might not be needed. At the same time, this is more recent and top of mind.

I thought the same thing when this came out. I left the existing examples but added a note referencing this most recent incident.

[melba-lopez]

Thank you @mlieberman85 for your review. I think this only needs one reviewer, but leaving for any other final comments from steering committee for another day (it was shared earlier in the week).

@inferno-chromium where was this blog draft shared? I don't believe there was a SLSA meeting last week, so trying to understand if it was in a different medium that I did not see.

[inferno-chromium]

Thank you @mlieberman85 for your review. I think this only needs one reviewer, but leaving for any other final comments from steering committee for another day (it was shared earlier in the week).

@inferno-chromium where was this blog draft shared? I don't believe there was a SLSA meeting last week, so trying to understand if it was in a different medium that I did not see.

This was shared on both slsa and tac openssf slack and here in the repo. We haven't needed discussions in SLSA meetings before. Feel free to take a look and let us know how would like to proceed.

[asraa]

LGTM!

[melba-lopez]

Thank you @mlieberman85 for your review. I think this only needs one reviewer, but leaving for any other final comments from steering committee for another day (it was shared earlier in the week).

@inferno-chromium where was this blog draft shared? I don't believe there was a SLSA meeting last week, so trying to understand if it was in a different medium that I did not see.

This was shared on both slsa and tac openssf slack and here in the repo. We haven't needed discussions in SLSA meetings before. Feel free to take a look and let us know how would like to proceed.

I see it now!! Thank you :) For some reason i didn't notice it (even though i posted right after it was shared)