Attestations

11 attestation schemas — each validates the CycloneDX attestation a pipeline emits to prove it meets a standard.

Legacy / CI 11

• Analysis Provenance Attestation · standard · JSON
  JSON Schema for analysis-provenance attestations in CycloneDX declarations format. Shape-only: inputRefs resolution into the sealed catalog,…
• Build Provenance Attestation · standard · JSON
  JSON Schema for build provenance attestations in CycloneDX format
• Case Catalog Integrity Attestation · standard · JSON
  JSON Schema for case-catalog (catalog-integrity) attestations in CycloneDX declarations format. Shape-only: corpus comparison, hash recomput…
• Catalog Approval Attestation · standard · JSON
  JSON Schema for human approval attestations
• Catalog Integrity Attestation · standard · JSON
  JSON Schema for automated catalog integrity attestations
• Container Vulnerability Scan Attestation · standard · JSON
  JSON Schema for container vulnerability scan attestations in CycloneDX format
• Custody Chain Attestation · standard · JSON
  JSON Schema for custody-chain attestations in CycloneDX declarations format. Shape-only: chain continuity (prevEventHash linkage), seq gaple…
• Finding Approval Attestation · standard · JSON
  JSON Schema for finding-approval attestations in CycloneDX declarations format. Shape-only: approver-not-equal-author (comparison against th…
• Method Validation Attestation · standard · JSON
  JSON Schema for method-validation attestations in CycloneDX declarations format. Shape-only: predicate/status agreement, validUntil window c…
• Publish Approval Attestation · standard · JSON
  JSON Schema for CyberBench publish-approval attestations in CycloneDX declarations format. Shape-only: approver-not-equal-author (comparison…
• Static Analysis Attestation · standard · JSON
  JSON Schema for static application security testing attestations in CycloneDX format