[SCITT] SCITT <-> OpenSSF terminology

[Zachary Newman <[e-mail]>]

Hi all,

I was asked at the last SCITT meeting to coordinate with the OpenSSF w/r/t terminology. Here’s what I’ve learned:

1. There’s no one effort to define terminology across the OpenSSF.
2. The OpenSSF is split up into “working groups”; some of these working groups have their own terminology but it’s not in a standard format or anything, you have to dig around.
3. Sigstore is the most pertinent OpenSSF project; they don’t have a formal terminology list (though they hope to at some point). I’m familiar with most of the terminology they use.

I will let this group know if any proposed SCITT terminology seems to conflict with the Sigstore language. The main potential issue seems to be “attestation,” which Sigstore mostly uses to mean SLSA attestations[1], which are themselves an extension of the in-toto attestation format. However, I think it’s mostly clear from context when it’s referring to the abstract idea of an attestation, or a specific attestation format. In general, it never uses the idea of a “remote attestation."

I will also let this group know there is ever a formal terminology document, which will be useful for compare/contrast.

Cheers,
Zack

[1] https://github.com/slsa-framework/slsa/blob/main/docs/attestation-model.md