Build Provenance Attestation

JSON Schema for build provenance attestations in CycloneDX format

Attests conformance to the build-provenance standard.Download raw JSON.

What this attestation claims

It asserts one of these predicates:

• built-from-verified-source
• built-in-trusted-environment
• reproducible-builds
• cryptographically-signed
• audit-trail-complete

About: The artifact this claim is about (image digest or PURL).

Evidence (carried inline):

gitSha

Git commit SHA (pattern: ^[0-9a-f]{40}$)

buildUrl

URL to the build execution

workflowPath

Path to the workflow definition

runner

Build runner information

How it's scored

Each mapped requirement carries two independent 0.0–1.0 scores, each with a rationale: conformance (how fully the requirement is met) and confidence (how sure the assessor is of that judgement).

Who may attest

Each attestation names an assessor described by:

bom-ref (required)

Unique identifier for this assessor

component (required)

the tool that produced the attestation (name + version)

organization

the attesting organization (name + URL)

thirdParty

Whether this is a third-party build system