Should SLSA 4 require retention of dependencies?

[MarkLodato]

We already require retention of sources. Do we require retention of the inputs to the build as well?

[MarkLodato]

@dlorenc Any opinions? My inclination is "no," SLSA 3 does not require the intermediate "built" artifacts to be retained. What do you think?

[dlorenc]

I'm not sure I understand the distinction between inputs and intermediate artifacts well enough to have an opinion.

Hermeticity implies no network access. Any type of retention policies seems orthogonal?

[msuozzo]

Yeah I think this should be "reproducible", not "hermetic."

[MarkLodato]

Sorry, tying to 'hermetic' was misleading. Should SLSA 3 require the retention of dependencies? Right now there is a SLSA 3 requirement that the top-level source is "retained indefinitely" (or 18 months at SLSA 2). That allows one to go back and audit the source. Should we have an equivalent requirement for any of the non-source dependencies? That would allow you to inspect libraries and build tools after-the-fact as well. Is that important enough to be a requirement?