### Problem to solve To comply with SLSA Level 3, GitLab must support provenance generation in a way that ensures the integrity and trustworthiness of build metadata. In Phase 1, provenance was generated within the Runner, meaning the attestation was produced in the same environment as the build, which creates trust boundary limitations. ### Proposal This epic covers Phase 2 of GitLab's SLSA provenance initiative, focused on shifting provenance generation from the Runner to the control plane. This approach enhances trust by ensuring provenance is generated by GitLab itself, not by the potentially user-controlled CI environment. #### DRIs * **DRI**: @darbyfrey * **PM**: @jocelynjane * **EM**: @fcatteau * **UX/PDM**: * **Group(s)**: ~"group::pipeline security" ### Implementation plan Issues to create: - [x] Use the already created [PoC SLSA provenance MR](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/190882) as a reference to define a conversion structure that transforms CI job data into a valid SLSA object [:issue: Rails backend SLSA attestation generation](https://gitlab.com/gitlab-org/gitlab/-/issues/546150) - [x] Implement an uploader service responsible for serializing and storing the SLSA object as an artifact, and associating it with the appropriate job or build, [:issue: Uploader service to store SLSA object as an artifact](https://gitlab.com/gitlab-org/gitlab/-/issues/546153) - [x] Implement Sidekiq worker for the uploader, could be merged into one issue with the uploader implementation [:issue: Implement Sidekiq worker for the SLSA attestation uploader](https://gitlab.com/gitlab-org/gitlab/-/issues/546178) - [x] Document how provenance is generated and behaves within the scope of a pipeline job [:issue: Document how provenance is generated and behaves within the scope of a pipeline job](https://gitlab.com/gitlab-org/gitlab/-/issues/546180) - [x] Inject the Sidekiq worker trigger into the event (TBD – job completion), controller behind a feature flag that is disabled by default. [:issue: Inject the Sidekiq worker trigger into the event](https://gitlab.com/gitlab-org/gitlab/-/issues/547865) - [x] Roll out the new provenance generation behind a feature flag [:issue: Roll out the new provenance generation behind a feature flag](https://gitlab.com/gitlab-org/gitlab/-/issues/547866)