-
Notifications
You must be signed in to change notification settings - Fork 148
Description
We are working on a tool to generate SPDX 3.0 documents describing Linux kernel builds, and we are struggling to find appropriate values for the buildType property in Build elements.
According to the specification, it is acceptable to use any IRI, although a well-known buildType is preferred:
"A buildType is an IRI expressing the toolchain, platform, or infrastructure that the build was invoked on. [...] If you are not using a well-known buildType, it should be namespaced to a domain you own to prevent conflicts with other buildType IRIs."
But what are well-known buildTypes? From what I could find, there are only two examples in the index-of-build-types: GitHub Actions Workflow and Google Cloud Build. Neither of these fits our situation.
We could of course choose an arbitrary IRI and assign it to each Build element, but what is the point then in this property? It would feel more like unnecessary boilerplate that provides little value.
Alternatively, we could define a dedicated SLSA build type specifically for kernel builds. But this seems like a lot of effort just to use Build elements effectively.
Are there recommendations on how to use the buildType property effectively?
Adding examples that utilize Build elements or a more detailed description of the buildType property would be very helpful. In its current form, the buildType property feels somewhat strange to use, especially since it is a required property.