[I] Optional identifier on creator, so a signer can be matched to a record [sourcelume-spec]

["vignesh-manel (via GitHub) via issues" <is...@sourcelume.apache.org>]

vignesh-manel opened a new issue, #14:
URL: https://github.com/apache/sourcelume-spec/issues/14

   ## Context
   
   From the dev-list thread on the attestation library. The spec says a record is "signed once, by whoever actually asserts it", but there is nothing in a record to match a signer against.
   
   Today:
   
   - Spec 0.0.1 describes each `creator` as a `schema:Organization` or `schema:Person` with a `name` and an optional `role`. Both schemas define only `type`, `name` and `role` for creator (extra fields are allowed, but none is defined).
   - A `TrainingProvenanceRecord`'s `creator` has the same shape as in `ProvenanceRecord`.
   
   ## Proposal (from the thread)
   
   Jamie suggested "an optional identifier on creator (IRI or DID)". Until then, v1 of the attestation library can carry the signer identity in the signature envelope, so this doesn't block it.
   
   ## Open questions
   
   - IRI only, or DIDs too?
   - The property name: the context already maps `id` to `@id`, so `id` on a creator would make it a linked node in JSON-LD.
   - How it relates to the identities the attestation library may support (X.509, Sigstore, DIDs, per the thread).
   
   ## Dev-list thread
   
   https://lists.apache.org/thread/bmwd61284jqrxhzvkzglh0kly1ln29d9 ("[DISCUSS]: Initiating development of the Sourcelume Attestation library")
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@sourcelume.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@sourcelume.apache.org
For additional commands, e-mail: issues-help@sourcelume.apache.org