[feature] SLSA Go builds tarball for builds

[naveensrinivasan]

Describe the bug The SLSA builder used in https://github.com/ossf/scorecard/issues/2024 had stopped creating tarballs.

We need tarballs.

[laurentsimon]

I think they expect tarball because the previous scorecard releases used them, but if everything was binaries I think they'd be OK with that (not all projects use tarball or zip for their release, so their script should be able to adapt). Right?

Note: once https://github.com/slsa-framework/slsa-github-generator/issues/500, we could update scorecard release to use multiple config files and it wold work. It's just not very friendly to do that :)

[laurentsimon]

In general, zipped files would also be nice to have. We can check what GoReleaser supports.

The next question is deciding were the provenance should be: inside the zip/tarball for each binary, or should it cover the entire zip/tarball.. or both?

[naveensrinivasan]

Note: once #500, we could update scorecard release to use multiple config files and it wold work. It's just not very friendly to do that :)

That would work! Thanks

[ianlewis]

@laurentsimon @naveensrinivasan is this issue still valid? can we close?

[naveensrinivasan]

This is good now