Move source track VSA info to the VSA spec?

[TomHennen]

Eventually, I think this list should be moved closer to the VSA spec itself so that users can reference the schema and these specific requirements together.

Originally posted by @marcelamelara in #1094 (comment)

[zachariahcox]

@TomHennen is there much work left to do here?

I think the goal is to say:

SLSA has two main phases: data production and policy evaluation. 

Provenance attestations are data production. 
They are generated by authoritative sources, sources responsible for overseeing the claims to which they attest. 

"VSAs" are policy evaluations. 
A policy can be evaluated against the tamper-resistant provenance attestations to produce a policy decision. 
The organization uses VSAs to determine whether a specific artifact, package, repository revision is suitable for the next phase of the SDLC.

[TomHennen]

@TomHennen is there much work left to do here?

I think the idea in this issue is to move the parts of source-requirements that talk about how to populate a VSA out of source-requirements.md and move them to https://slsa.dev/spec/draft/verification_summary.

So it's just moving content. I'm not sure if I like that idea (haven't thought about it much), but I wanted to capture @marcelamelara's request from another PR.

Regarding your suggestion, yes that makes sense, though it does miss that VSAs are also intended to be used outside the organization. However, that might be tracked better in a separate issue or PR?

[TomHennen]

We can probably also have a spot for other SLSA tracks to indicate what properties they cover and how VSAs should refer to the various types of things (source revisions, artifacts, build environments...). See #1115 (comment) for context

[TomHennen]

I'd like to put this off until 1.1 is released. Otherwise it's just going to be more difficult for @lehors to produce the 1.1 version.

[lehors]

Yes, please! Thanks @TomHennen.