Discussion: How does runtime monitoring of a build fit into SLSA?

[marcelamelara]

So far, we've been considering an L4 for the upcoming build environment track that covers hardware-attested runtime integrity checking (e.g., FS accesses). But in a private discussion with @paveliak today, we concluded that runtime monitoring may also include various other aspects about a build environment's behavior, such as network accesses, file system changes. Two points came up for us:

1. This could be related to hermetic builds in that runtime monitoring could provide evidence for the hermeticity of a build. Should this be within the scope of a future hermetic builds requirement?

2. Runtime security monitoring of builds is a larger problem space that could address other classes of threats, some of which, wouldn't be caught through hash-based integrity checking. Is there a new potential track here that focuses on the runtime behavior of a build system?