Skip to content

Recommendations for buildType property #1321

@augelu-tng

Description

@augelu-tng

We are working on a tool to generate SPDX 3.0 documents describing Linux kernel builds, and we are struggling to find appropriate values for the buildType property in Build elements.

According to the specification, it is acceptable to use any IRI, although a well-known buildType is preferred:

"A buildType is an IRI expressing the toolchain, platform, or infrastructure that the build was invoked on. [...] If you are not using a well-known buildType, it should be namespaced to a domain you own to prevent conflicts with other buildType IRIs."

But what are well-known buildTypes? From what I could find, there are only two examples in the index-of-build-types: GitHub Actions Workflow and Google Cloud Build. Neither of these fits our situation.

We could of course choose an arbitrary IRI and assign it to each Build element, but what is the point then in this property? It would feel more like unnecessary boilerplate that provides little value.
Alternatively, we could define a dedicated SLSA build type specifically for kernel builds. But this seems like a lot of effort just to use Build elements effectively.

Are there recommendations on how to use the buildType property effectively?
Adding examples that utilize Build elements or a more detailed description of the buildType property would be very helpful. In its current form, the buildType property feels somewhat strange to use, especially since it is a required property.

Metadata

Metadata

Assignees

No one assigned

    Labels

    doc improvementArea where the project documentation needs improvementexamplesExamples in all formsquestionRequest for info or clarification

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions