From e22d100163565164e2149f99ab54d11a6111932b Mon Sep 17 00:00:00 2001 From: Yangjunjie Lin Date: Sun, 13 Sep 2026 12:31:37 +0100 Subject: [PATCH 1/6] fix(release): bind npm provenance source to GitHub certificate identity --- scripts/npm-provenance-identity.mjs | 27 +++++++++++++++ scripts/prepare-v2.1-npm-artifacts.mjs | 8 ++--- scripts/verify-v2.1-artifact-builds.mjs | 11 +++++++ tests/unit/npm-provenance-identity.test.ts | 38 ++++++++++++++++++++++ 4 files changed, 80 insertions(+), 4 deletions(-) create mode 100644 scripts/npm-provenance-identity.mjs create mode 100644 tests/unit/npm-provenance-identity.test.ts diff --git a/scripts/npm-provenance-identity.mjs b/scripts/npm-provenance-identity.mjs new file mode 100644 index 0000000..b54e7f2 --- /dev/null +++ b/scripts/npm-provenance-identity.mjs @@ -0,0 +1,27 @@ +import assert from "node:assert/strict"; + +const repository = "https://github.com/Yangjunjie-Lin/Scanly"; +const workflowPath = ".github/workflows/v2.1-artifact-qualification.yml"; + +// npm Registry binds dependency zero to the GitHub OIDC certificate, not to +// an independently checked-out product. Keep both identities without spoofing +// the runner environment or replacing the actual product-source dependency. +export function npmBuildDependencies(sourceCommit, workflowCommit, workflowRef) { + for (const commit of [sourceCommit, workflowCommit]) assert.match(commit ?? "", /^[a-f0-9]{40}$/); + assert.match(workflowRef ?? "", /^refs\/(heads|tags|pull)\//); + return [ + { uri: `git+${repository}@${workflowRef}`, digest: { gitCommit: workflowCommit } }, + { uri: `git+${repository}@${sourceCommit}`, digest: { gitCommit: sourceCommit } }, + ]; +} + +export function validateNpmBuildIdentity(statement, { sourceCommit, workflowCommit, workflowRef }) { + assert.equal(statement._type, "https://in-toto.io/Statement/v1"); + assert.equal(statement.predicateType, "https://slsa.dev/provenance/v1"); + const definition = statement.predicate.buildDefinition; + assert.equal(definition.buildType, "https://slsa-framework.github.io/github-actions-buildtypes/workflow/v1"); + assert.deepEqual(definition.externalParameters.workflow, { ref: workflowRef, repository, path: workflowPath }); + assert.equal(definition.externalParameters.source_commit, sourceCommit); + assert.deepEqual(definition.resolvedDependencies, npmBuildDependencies(sourceCommit, workflowCommit, workflowRef)); + assert.equal(statement.predicate.runDetails.builder.id, "https://github.com/actions/runner/github-hosted"); +} diff --git a/scripts/prepare-v2.1-npm-artifacts.mjs b/scripts/prepare-v2.1-npm-artifacts.mjs index 27f7710..9e7ce10 100644 --- a/scripts/prepare-v2.1-npm-artifacts.mjs +++ b/scripts/prepare-v2.1-npm-artifacts.mjs @@ -4,6 +4,7 @@ import fs from "node:fs"; import path from "node:path"; import { execFileSync } from "node:child_process"; import { createRequire } from "node:module"; +import { npmBuildDependencies, validateNpmBuildIdentity } from "./npm-provenance-identity.mjs"; const args = Object.fromEntries(process.argv.slice(2).map((arg) => { const separator = arg.indexOf("="); @@ -38,6 +39,7 @@ const workflowRef = process.env.GITHUB_WORKFLOW_REF; assert.ok(workflowRef?.startsWith("Yangjunjie-Lin/Scanly/.github/workflows/v2.1-artifact-qualification.yml@")); const workflowPath = ".github/workflows/v2.1-artifact-qualification.yml"; const workflowGitRef = workflowRef.slice(workflowRef.indexOf("@") + 1); +assert.equal(workflowGitRef, process.env.GITHUB_REF, "The non-reusable workflow and OIDC source refs must agree"); const invocationId = `https://github.com/Yangjunjie-Lin/Scanly/actions/runs/${process.env.GITHUB_RUN_ID}/attempts/${process.env.GITHUB_RUN_ATTEMPT}`; for (const folder of ["packages", "engines"]) { @@ -63,14 +65,12 @@ for (const folder of ["packages", "engines"]) { buildType: "https://slsa-framework.github.io/github-actions-buildtypes/workflow/v1", externalParameters: { workflow: { ref: workflowGitRef, repository: "https://github.com/Yangjunjie-Lin/Scanly", path: workflowPath }, source_commit: sourceCommit }, internalParameters: { github: { event_name: process.env.GITHUB_EVENT_NAME, repository_id: process.env.GITHUB_REPOSITORY_ID, repository_owner_id: process.env.GITHUB_REPOSITORY_OWNER_ID } }, - resolvedDependencies: [ - { uri: `git+https://github.com/Yangjunjie-Lin/Scanly@${sourceCommit}`, digest: { gitCommit: sourceCommit } }, - { uri: `git+https://github.com/Yangjunjie-Lin/Scanly@${workflowGitRef}`, digest: { gitCommit: process.env.GITHUB_SHA } }, - ], + resolvedDependencies: npmBuildDependencies(sourceCommit, process.env.GITHUB_SHA, process.env.GITHUB_REF), }, runDetails: { builder: { id: "https://github.com/actions/runner/github-hosted" }, metadata: { invocationId } }, }, }; + validateNpmBuildIdentity(statement, { sourceCommit, workflowCommit: process.env.GITHUB_SHA, workflowRef: process.env.GITHUB_REF }); const bundle = await sigstore.attest(Buffer.from(JSON.stringify(statement)), "application/vnd.in-toto+json"); await sigstore.verify(bundle); const provenanceFile = `${packed.filename}.sigstore.json`; diff --git a/scripts/verify-v2.1-artifact-builds.mjs b/scripts/verify-v2.1-artifact-builds.mjs index aa685fd..8b367e1 100644 --- a/scripts/verify-v2.1-artifact-builds.mjs +++ b/scripts/verify-v2.1-artifact-builds.mjs @@ -4,6 +4,7 @@ import fs from "node:fs"; import path from "node:path"; import { createRequire } from "node:module"; import { execFileSync } from "node:child_process"; +import { validateNpmBuildIdentity } from "./npm-provenance-identity.mjs"; const args = Object.fromEntries(process.argv.slice(2).map((arg) => { const separator = arg.indexOf("="); @@ -41,6 +42,7 @@ for (let i = 0; i < reports.length; i++) { assert.equal(report.published, false); assert.equal(report.buildLabel, label); assert.equal(report.runId, run.databaseId); + assert.equal(report.workflowDefinitionCommit, run.headSha); assert.equal(report.artifacts.length, 11); assert.ok(report.workflowRef.startsWith("Yangjunjie-Lin/Scanly/.github/workflows/v2.1-artifact-qualification.yml@")); const job = run.jobs.find((entry) => entry.name === `Clean npm build ${label}`); @@ -70,6 +72,14 @@ for (let i = 0; i < reports.length; i++) { assert.equal(statement.predicateType, "https://slsa.dev/provenance/v1"); assert.equal(statement.predicate.buildDefinition.externalParameters.source_commit, sourceCommit); assert.ok(statement.predicate.buildDefinition.resolvedDependencies.some((dependency) => dependency.digest.gitCommit === sourceCommit)); + if (args["npm-compatible"] === "true") { + validateNpmBuildIdentity(statement, { sourceCommit, workflowCommit: run.headSha, workflowRef: report.workflowRef.split("@")[1] }); + } + if (args["frozen-artifacts"]) { + const frozen = read(args["frozen-artifacts"]).artifacts.find((entry) => path.basename(entry.path) === artifact.filename); + assert.ok(frozen, `Missing frozen artifact ${artifact.filename}`); + assert.equal(frozen.sha256, artifact.sha256, "Fresh builds must match the frozen release bytes"); + } if (i === 0) { names.add(artifact.name); provenances.push({ package: artifact.name, file: path.relative(root, file).replaceAll("\\", "/"), sha256: artifact.provenanceSha256, artifactSha256: artifact.sha256, artifactSha512: artifact.sha512, certificateIdentity: `https://github.com/${report.workflowRef}`, verified: true }); } } maps.push(hashes); @@ -80,6 +90,7 @@ assert.equal(names.size, 11); assert.ok(names.has("@scanly/url-safety")); const result = { schemaVersion: "scanly-v2.1-npm-reproducibility-1", version: "2.1.0", sourceCommit, sourceTree, status: "PASS", independentBuildJobs: jobs, runId: run.databaseId, cleanBuildRunA: `https://github.com/Yangjunjie-Lin/Scanly/actions/runs/${run.databaseId}/job/${jobs[0]}`, cleanBuildRunB: `https://github.com/Yangjunjie-Lin/Scanly/actions/runs/${run.databaseId}/job/${jobs[1]}`, cleanBuildA: maps[0], cleanBuildB: maps[1], rawBuildAEqualsBuildB: true, detachedProvenanceVerified: provenances, packageCount: names.size, published: false }; const output = path.resolve(args.output); +assert.ok(!fs.existsSync(output), "Never overwrite qualification evidence"); fs.mkdirSync(path.dirname(output), { recursive: true }); fs.writeFileSync(output, JSON.stringify(result, null, 2) + "\n"); console.log("V2_1_NPM_ARTIFACT_REPRODUCIBILITY_GO: 11 byte-identical tarballs; 22 issuer/identity/subject-bound provenance bundles verified. No publication performed."); diff --git a/tests/unit/npm-provenance-identity.test.ts b/tests/unit/npm-provenance-identity.test.ts new file mode 100644 index 0000000..5d1747f --- /dev/null +++ b/tests/unit/npm-provenance-identity.test.ts @@ -0,0 +1,38 @@ +import { describe, expect, it } from "vitest"; +// @ts-expect-error release MJS is not part of the SDK declarations +import { npmBuildDependencies, validateNpmBuildIdentity } from "../../scripts/npm-provenance-identity.mjs"; + +const sourceCommit = "a".repeat(40), workflowCommit = "b".repeat(40), workflowRef = "refs/heads/codex/recovery"; +const identity = { sourceCommit, workflowCommit, workflowRef }; +const makeStatement = () => ({ + _type: "https://in-toto.io/Statement/v1", predicateType: "https://slsa.dev/provenance/v1", + predicate: { + buildDefinition: { + buildType: "https://slsa-framework.github.io/github-actions-buildtypes/workflow/v1", + externalParameters: { source_commit: sourceCommit, workflow: { ref: workflowRef, repository: "https://github.com/Yangjunjie-Lin/Scanly", path: ".github/workflows/v2.1-artifact-qualification.yml" } }, + resolvedDependencies: npmBuildDependencies(sourceCommit, workflowCommit, workflowRef), + }, + runDetails: { builder: { id: "https://github.com/actions/runner/github-hosted" } }, + }, +}); +describe("npm Registry provenance source identity", () => { + it("binds dependency zero to the certificate source while retaining the exact product source", () => { + const statement = makeStatement(); + expect(statement.predicate.buildDefinition.resolvedDependencies[0].digest.gitCommit).toBe(workflowCommit); + expect(statement.predicate.buildDefinition.resolvedDependencies[1].digest.gitCommit).toBe(sourceCommit); + expect(() => validateNpmBuildIdentity(statement, identity)).not.toThrow(); + }); + it("rejects the originally registry-rejected dependency order", () => { + const statement = makeStatement(); statement.predicate.buildDefinition.resolvedDependencies.reverse(); + expect(() => validateNpmBuildIdentity(statement, identity)).toThrow(); + }); + it.each(["sourceCommit", "workflowCommit", "workflowRef"])("rejects a substituted %s", (key) => { + expect(() => validateNpmBuildIdentity(makeStatement(), { ...identity, [key]: key === "workflowRef" ? "refs/heads/main" : "c".repeat(40) })).toThrow(); + }); + it("rejects missing actual product evidence and non-GitHub hosted builders", () => { + const statement = makeStatement(); statement.predicate.buildDefinition.resolvedDependencies.pop(); + expect(() => validateNpmBuildIdentity(statement, identity)).toThrow(); + const other = makeStatement(); other.predicate.runDetails.builder.id = "self-hosted"; + expect(() => validateNpmBuildIdentity(other, identity)).toThrow(); + }); +}); From 7e8c1eb8a27af0b514e68cdb8e99c70b860da831 Mon Sep 17 00:00:00 2001 From: Yangjunjie Lin Date: Sun, 13 Sep 2026 12:37:05 +0100 Subject: [PATCH 2/6] release: append independently rebuilt npm provenance recovery evidence --- .gitattributes | 1 + docs/releases/v2.1.0.md | 8 + .../v2.1.0/publication-recovery/build-A.json | 150 +++++++++++ .../v2.1.0/publication-recovery/build-B.json | 150 +++++++++++ .../scanly-benchmark-2.1.0.tgz.sigstore.json | 61 +++++ .../scanly-browser-2.1.0.tgz.sigstore.json | 60 +++++ .../scanly-core-2.1.0.tgz.sigstore.json | 62 +++++ ...scanly-engine-jsqr-2.1.0.tgz.sigstore.json | 62 +++++ ...ine-zxing-cpp-wasm-2.1.0.tgz.sigstore.json | 60 +++++ ...ly-engine-zxing-js-2.1.0.tgz.sigstore.json | 59 +++++ .../scanly-node-2.1.0.tgz.sigstore.json | 61 +++++ .../scanly-parsers-2.1.0.tgz.sigstore.json | 60 +++++ .../scanly-react-2.1.0.tgz.sigstore.json | 59 +++++ ...ly-scenario-schema-2.1.0.tgz.sigstore.json | 61 +++++ .../scanly-url-safety-2.1.0.tgz.sigstore.json | 60 +++++ .../scanly-benchmark-2.1.0.tgz.sigstore.json | 61 +++++ .../scanly-browser-2.1.0.tgz.sigstore.json | 58 +++++ .../scanly-core-2.1.0.tgz.sigstore.json | 60 +++++ ...scanly-engine-jsqr-2.1.0.tgz.sigstore.json | 60 +++++ ...ine-zxing-cpp-wasm-2.1.0.tgz.sigstore.json | 62 +++++ ...ly-engine-zxing-js-2.1.0.tgz.sigstore.json | 62 +++++ .../scanly-node-2.1.0.tgz.sigstore.json | 62 +++++ .../scanly-parsers-2.1.0.tgz.sigstore.json | 63 +++++ .../scanly-react-2.1.0.tgz.sigstore.json | 60 +++++ ...ly-scenario-schema-2.1.0.tgz.sigstore.json | 60 +++++ .../scanly-url-safety-2.1.0.tgz.sigstore.json | 62 +++++ .../qualification-run.json | 241 ++++++++++++++++++ .../publication-recovery/reproducibility.json | 146 +++++++++++ .../v2.1.0/v2.1.0-provenance-recovery.json | 143 +++++++++++ scripts/publish-v2.1-bootstrap.mjs | 45 +++- scripts/record-v2.1-provenance-recovery.mjs | 58 +++++ 31 files changed, 2276 insertions(+), 1 deletion(-) create mode 100644 release/stable/v2.1.0/publication-recovery/build-A.json create mode 100644 release/stable/v2.1.0/publication-recovery/build-B.json create mode 100644 release/stable/v2.1.0/publication-recovery/provenance-A/scanly-benchmark-2.1.0.tgz.sigstore.json create mode 100644 release/stable/v2.1.0/publication-recovery/provenance-A/scanly-browser-2.1.0.tgz.sigstore.json create mode 100644 release/stable/v2.1.0/publication-recovery/provenance-A/scanly-core-2.1.0.tgz.sigstore.json create mode 100644 release/stable/v2.1.0/publication-recovery/provenance-A/scanly-engine-jsqr-2.1.0.tgz.sigstore.json create mode 100644 release/stable/v2.1.0/publication-recovery/provenance-A/scanly-engine-zxing-cpp-wasm-2.1.0.tgz.sigstore.json create mode 100644 release/stable/v2.1.0/publication-recovery/provenance-A/scanly-engine-zxing-js-2.1.0.tgz.sigstore.json create mode 100644 release/stable/v2.1.0/publication-recovery/provenance-A/scanly-node-2.1.0.tgz.sigstore.json create mode 100644 release/stable/v2.1.0/publication-recovery/provenance-A/scanly-parsers-2.1.0.tgz.sigstore.json create mode 100644 release/stable/v2.1.0/publication-recovery/provenance-A/scanly-react-2.1.0.tgz.sigstore.json create mode 100644 release/stable/v2.1.0/publication-recovery/provenance-A/scanly-scenario-schema-2.1.0.tgz.sigstore.json create mode 100644 release/stable/v2.1.0/publication-recovery/provenance-A/scanly-url-safety-2.1.0.tgz.sigstore.json create mode 100644 release/stable/v2.1.0/publication-recovery/provenance-B/scanly-benchmark-2.1.0.tgz.sigstore.json create mode 100644 release/stable/v2.1.0/publication-recovery/provenance-B/scanly-browser-2.1.0.tgz.sigstore.json create mode 100644 release/stable/v2.1.0/publication-recovery/provenance-B/scanly-core-2.1.0.tgz.sigstore.json create mode 100644 release/stable/v2.1.0/publication-recovery/provenance-B/scanly-engine-jsqr-2.1.0.tgz.sigstore.json create mode 100644 release/stable/v2.1.0/publication-recovery/provenance-B/scanly-engine-zxing-cpp-wasm-2.1.0.tgz.sigstore.json create mode 100644 release/stable/v2.1.0/publication-recovery/provenance-B/scanly-engine-zxing-js-2.1.0.tgz.sigstore.json create mode 100644 release/stable/v2.1.0/publication-recovery/provenance-B/scanly-node-2.1.0.tgz.sigstore.json create mode 100644 release/stable/v2.1.0/publication-recovery/provenance-B/scanly-parsers-2.1.0.tgz.sigstore.json create mode 100644 release/stable/v2.1.0/publication-recovery/provenance-B/scanly-react-2.1.0.tgz.sigstore.json create mode 100644 release/stable/v2.1.0/publication-recovery/provenance-B/scanly-scenario-schema-2.1.0.tgz.sigstore.json create mode 100644 release/stable/v2.1.0/publication-recovery/provenance-B/scanly-url-safety-2.1.0.tgz.sigstore.json create mode 100644 release/stable/v2.1.0/publication-recovery/qualification-run.json create mode 100644 release/stable/v2.1.0/publication-recovery/reproducibility.json create mode 100644 release/stable/v2.1.0/v2.1.0-provenance-recovery.json create mode 100644 scripts/record-v2.1-provenance-recovery.mjs diff --git a/.gitattributes b/.gitattributes index d83f84f..c809857 100644 --- a/.gitattributes +++ b/.gitattributes @@ -27,5 +27,6 @@ release/stable/v*/artifacts/android/*.aar binary release/stable/v*/artifacts/npm/*.tgz binary release/stable/v2.1.0/evidence/** text eol=lf release/stable/v2.1.0/artifacts/provenance/*.json text eol=lf +release/stable/v2.1.0/publication-recovery/** text eol=lf device-lab/test-targets/sha256.json text eol=lf fixtures/alpha5/external-open-license/pdf417/ZXING-APACHE-2.0.txt text eol=lf diff --git a/docs/releases/v2.1.0.md b/docs/releases/v2.1.0.md index 5f814b2..86dcd2d 100644 --- a/docs/releases/v2.1.0.md +++ b/docs/releases/v2.1.0.md @@ -31,3 +31,11 @@ All software, browser, API/package, security, Native, SBOM/license, artifact/rep The Stable manifest generator refuses new-version generation without `STABLE_QUALIFICATION_RECORD`: an exact-source `scanly-release-qualification-1` record with version, sourceCommit, sourceTree and content-addressed PASS evidence (`path`, `sha256`, `sourceCommit`) for software, apiAbi, security, sbom, licenses, native, npmReproducibility, signing, publicationCredentials and deployment. Fresh public signing metadata and two independent npm build/hash maps are required. Legacy 2.0.x GO/credential/reproducibility claims cannot be inherited. For the new `@scanly/url-safety` package only, the qualified first-publication path uses npm's official `--provenance-file` support: exact release tarball bytes carry a GitHub-hosted build's verified Sigstore provenance, while an authenticated owner completes npm's interactive 2FA locally. No npm credential is sent to CI, no placeholder version is published, and no provenance or signing requirement is waived. Existing packages continue using their verified OIDC workflow. Dependencies publish before the new package; a deferred bootstrap is reported as incomplete, never as full release success. The new package's Trusted Publisher can be initialized after its first genuine release. + +### Additive provenance compatibility correction + +The first Registry submission was rejected with E422: although the original Sigstore signatures and artifact subjects verified cryptographically, npm requires `resolvedDependencies[0]` to match the GitHub certificate's source repository ref and commit. The original bundles listed the separately checked-out product source first. The rejected submission did not publish the new package. + +[The additive recovery record](../../release/stable/v2.1.0/v2.1.0-provenance-recovery.json) preserves this failure and binds replacement proofs to two fresh independent GitHub-hosted builds. All 11 rebuilt tarballs match the frozen release byte-for-byte; all 22 replacement bundles are signature-, identity-, and subject-verified. The workflow source is now first and the exact product source remains a separate explicit dependency. The signed tag, original manifest, original provenance, and frozen artifacts remain unchanged. + +Use `npm run stable:bootstrap -- --qualified-provenance-recovery` only with this verified additive record. The command rechecks the live successful workflow, both independent signed URL Safety bundles, exact artifact hashes, original qualification, and owner authentication before requesting publication. A completed build or local signature check is not proof of Registry acceptance; post-publication checks remain mandatory. diff --git a/release/stable/v2.1.0/publication-recovery/build-A.json b/release/stable/v2.1.0/publication-recovery/build-A.json new file mode 100644 index 0000000..b68ab6d --- /dev/null +++ b/release/stable/v2.1.0/publication-recovery/build-A.json @@ -0,0 +1,150 @@ +{ + "schemaVersion": "scanly-v2.1-npm-build-1", + "version": "2.1.0", + "sourceCommit": "6b017b53a4404f4feab776ac111b0ea9dacf2734", + "sourceTree": "c72430a2ab0a2d47e7cd095325088f1e053a5c41", + "workflowDefinitionCommit": "e22d100163565164e2149f99ab54d11a6111932b", + "workflowRef": "Yangjunjie-Lin/Scanly/.github/workflows/v2.1-artifact-qualification.yml@refs/heads/codex/v2.1-npm-provenance-recovery", + "buildLabel": "A", + "runId": 34754673547, + "runAttempt": 1, + "invocationId": "https://github.com/Yangjunjie-Lin/Scanly/actions/runs/34754673547/attempts/1", + "nodeVersion": "v24.20.0", + "npmVersion": "11.12.1", + "repositoryDirty": false, + "published": false, + "artifacts": [ + { + "name": "@scanly/benchmark", + "version": "2.1.0", + "filename": "scanly-benchmark-2.1.0.tgz", + "size": 12489, + "sha256": "468b1cf37bf229029651fa1e6d6ec63414902578ea1f34b1f8632704ee47e9dd", + "sha512": "6e262c1f70df8cc03d30f8d096d7cf3fcfbaf392d5e9e7fea4ac3da4d3d098f95c9f064b6a75c738b49e984b4176b1e2b7a0d648e877bc6261962bcbec60d5cf", + "integrity": "sha512-biYsH3DfjMA9MPjQltfPP8+685LV6ef+pKw9pNPQmPlcnwZLanXHOLSemEtBdrHit6DWSOh3vGJhlivL7GDVzw==", + "provenanceFile": "scanly-benchmark-2.1.0.tgz.sigstore.json", + "provenanceSha256": "9ca8c601edf25db755ac9773a0e208cfad29eb62e24489a34edd9d17bd466d93", + "purl": "pkg:npm/%40scanly/benchmark@2.1.0" + }, + { + "name": "@scanly/browser", + "version": "2.1.0", + "filename": "scanly-browser-2.1.0.tgz", + "size": 112845, + "sha256": "c173f88dab2a0402ee549c9e609868c2b50145a8096ecc3c0c668a2823b92727", + "sha512": "07ffa207aa2a82609b0e808ae9221c3c773590406b3fe11dd45e4cf9840fc162170e42efda8d82ef72b39b9f33308e84db818a0239e563b37c66d008c768cf3e", + "integrity": "sha512-B/+iB6oqgmCbDoCK6SIcPHc1kEBrP+Ed1F5M+YQPwWIXDkLv2o2C73Kzm58zMI6E24GKAjnlY7N8ZtAIx2jPPg==", + "provenanceFile": "scanly-browser-2.1.0.tgz.sigstore.json", + "provenanceSha256": "bfe37937da67ce98d45bccc4aca2a7200040cf13860ff9d5b139d220c3be138a", + "purl": "pkg:npm/%40scanly/browser@2.1.0" + }, + { + "name": "@scanly/core", + "version": "2.1.0", + "filename": "scanly-core-2.1.0.tgz", + "size": 133351, + "sha256": "7a529c1c940ace1d961bd1df668f668623bcbac1527827579433efffeb10e416", + "sha512": "c6a81231287f8c9b7a7e30481f65d497496771b003d7d3114a0bc7cdec03baac801baa6c095978b91d77f48ec489a03205508289cdfcdee9b72a5e8ead10e2bd", + "integrity": "sha512-xqgSMSh/jJt6fjBIH2XUl0lncbAD19MRSgvHzewDuqyAG6psCVl4uR139I7EiaAyBVCCic383um3Kl6OrRDivQ==", + "provenanceFile": "scanly-core-2.1.0.tgz.sigstore.json", + "provenanceSha256": "2ed45b23d5f2fb1248f007c53a02af0498cfe065df353d583e439f0c4558e5f2", + "purl": "pkg:npm/%40scanly/core@2.1.0" + }, + { + "name": "@scanly/engine-jsqr", + "version": "2.1.0", + "filename": "scanly-engine-jsqr-2.1.0.tgz", + "size": 2737, + "sha256": "b530dcb7949290f068fa3dd3805c0ee23b26d4554cc920f058f1c6c6f3afc68b", + "sha512": "4550a7b56196e3f686de41cf278f9f28c9a9d57ccb6e6277a0ff707ecd8422c24d0ba53f63851d181b4b08b62026fc5d2b3191c522bc9c38d7745a0d58854d35", + "integrity": "sha512-RVCntWGW4/aG3kHPJ4+fKMmp1XzLbmJ3oP9wfs2EIsJNC6U/Y4UdGBtLCLYgJvxdKzGRxSK8nDjXdFoNWIVNNQ==", + "provenanceFile": "scanly-engine-jsqr-2.1.0.tgz.sigstore.json", + "provenanceSha256": "2dc6df190d4e04822c61c8eed2412a814154772671de71c5c530863ea71528cd", + "purl": "pkg:npm/%40scanly/engine-jsqr@2.1.0" + }, + { + "name": "@scanly/engine-zxing-cpp-wasm", + "version": "2.1.0", + "filename": "scanly-engine-zxing-cpp-wasm-2.1.0.tgz", + "size": 472873, + "sha256": "5215d8e09ff67ea07cececae51d34a975ae0396723ab235c627081568b1b796c", + "sha512": "46734c49cc0776b26edc1fa6261f78a028a6dd0ec97a7433cd22101648836faeba04c547e90510372fa7da4133d0303f85118cec2b17100581a160cb047bbc39", + "integrity": "sha512-RnNMScwHdrJu3B+mJh94oCim3Q7JenQzzSIQFkiDb666BMVH6QUQNy+n2kEz0DA/hRGM7CsXEAWBoWDLBHu8OQ==", + "provenanceFile": "scanly-engine-zxing-cpp-wasm-2.1.0.tgz.sigstore.json", + "provenanceSha256": "e97c51ce77400e173ab5623bba5864cf9a6ea6e4a706b6c8808fdc113090158d", + "purl": "pkg:npm/%40scanly/engine-zxing-cpp-wasm@2.1.0" + }, + { + "name": "@scanly/engine-zxing-js", + "version": "2.1.0", + "filename": "scanly-engine-zxing-js-2.1.0.tgz", + "size": 3188, + "sha256": "420c12ac6a7170c004cee7ce25af9e69f56165b1d50e31ebb1acf4eb03b2eecf", + "sha512": "49a7c63ddf6317b9662f1be45d92b8ea9289fbb51d4d364a5c1e3e899e82101afd268d26a8af25cb8a739bd4d213f23ea499d4cb5b00e95fff6dc7cfcf0d0fda", + "integrity": "sha512-SafGPd9jF7lmLxvkXZK46pKJ+7UdTTZKXB4+iZ6CEBr9Jo0mqK8ly4pzm9TSE/I+pJnUy1sA6V//bcfPzw0P2g==", + "provenanceFile": "scanly-engine-zxing-js-2.1.0.tgz.sigstore.json", + "provenanceSha256": "ddea3326749fde9c41cb5f64f8764ab1d2b5ddc39bb80b05c96eebcfdee8f2f7", + "purl": "pkg:npm/%40scanly/engine-zxing-js@2.1.0" + }, + { + "name": "@scanly/node", + "version": "2.1.0", + "filename": "scanly-node-2.1.0.tgz", + "size": 4163, + "sha256": "13207d6afba9038cf721bb9462ff096aedaa658ed22596c10f5529eb08fc3573", + "sha512": "88f404c159d400a4a03eff00294ad2076dc17dbc84b253c33fc8b742b975becc35d602e9fa529ff0ca91dc635148a8078d5564880973a63c49a2a7c6d1dc337e", + "integrity": "sha512-iPQEwVnUAKSgPv8AKUrSB23BfbyEslPDP8i3Qrl1vsw11gLp+lKf8MqR3GNRSKgHjVVkiAlzpjxJoqfG0dwzfg==", + "provenanceFile": "scanly-node-2.1.0.tgz.sigstore.json", + "provenanceSha256": "940ca61b1285dbf2462d3a3a05a8774298c0f7b965d0790b7660192daa9e5a15", + "purl": "pkg:npm/%40scanly/node@2.1.0" + }, + { + "name": "@scanly/parsers", + "version": "2.1.0", + "filename": "scanly-parsers-2.1.0.tgz", + "size": 5415, + "sha256": "2d71b9713d1b8d084b8c9bdeb0ffbe079b3df54a16488e50dabe857c374cb868", + "sha512": "1aa6833407e9d26ad02b160f253796e73d9517c5c9aa5d6d64795fccc37591f4d1997f443ff5ba34f0c05fea35c9bb217b23916f4b2418ef04f099a88b594755", + "integrity": "sha512-GqaDNAfp0mrQKxYPJTeW5z2VF8XJql1tZHlfzMN1kfTRmX9EP/W6NPDAX+o1ybsheyORb0skGO8E8Jmoi1lHVQ==", + "provenanceFile": "scanly-parsers-2.1.0.tgz.sigstore.json", + "provenanceSha256": "dfd7825c577634ec9846b2c4d056b19948a82292c28c35e6ce914238b4cd5076", + "purl": "pkg:npm/%40scanly/parsers@2.1.0" + }, + { + "name": "@scanly/react", + "version": "2.1.0", + "filename": "scanly-react-2.1.0.tgz", + "size": 2873, + "sha256": "e709ec6f963a91f593a55efcda65e5cf524774154496a1011d8474bb7ab9b8ff", + "sha512": "8c2b8ee908aa097ce7c132a4fbd3671e1264665ed4cd34a7de3cc52188e800acbd2dd8d255cdb10f786b68638310d8301a11fb6c8c71b7e080bda88741f0a497", + "integrity": "sha512-jCuO6QiqCXznwTKk+9NnHhJkZl7UzTSn3jzFIYjoAKy9LdjSVc2xD3hraGODENgwGhH7bIxxt+CAvaiHQfCklw==", + "provenanceFile": "scanly-react-2.1.0.tgz.sigstore.json", + "provenanceSha256": "7c58ddb012647412971c5d3acbb904cd8961d3bf440b75db5aded7c8321a14a8", + "purl": "pkg:npm/%40scanly/react@2.1.0" + }, + { + "name": "@scanly/scenario-schema", + "version": "2.1.0", + "filename": "scanly-scenario-schema-2.1.0.tgz", + "size": 10376, + "sha256": "b55e951e1fcd5e129200beab60ee057dee23d4694409df75d007c0953a7e90b1", + "sha512": "973fc3a387a978f8f52e63a82f574cf829c2bdd12bb5b0ad7f5766206e8610269d0e69aae90eb45f560f794a9223f9422010d54bc8a40e82ae32c027468eddbe", + "integrity": "sha512-lz/Do4epePj1LmOoL1dM+CnCvdErtbCtf1dmIG6GECadDmmq6Q60X1YPeUqSI/lCIBDVS8ikDoKuMsAnRo7dvg==", + "provenanceFile": "scanly-scenario-schema-2.1.0.tgz.sigstore.json", + "provenanceSha256": "f77c63558cca55d8b8e7aad1bfc4f322085230ab73136915c418e864839b4c90", + "purl": "pkg:npm/%40scanly/scenario-schema@2.1.0" + }, + { + "name": "@scanly/url-safety", + "version": "2.1.0", + "filename": "scanly-url-safety-2.1.0.tgz", + "size": 35468, + "sha256": "72bbd5974b2a0b0c2c1ded6098c249084df0fbffe50a937ef96e68902b914a87", + "sha512": "269e2f2ed7dbb71926b1eaf33e06df8ed17cf1a0aa16b741252fa2c59a3929588d7549e5aa6655d142bff1b19803db8ad5bf3949562df4d65eba53a84d531c5e", + "integrity": "sha512-Jp4vLtfbtxkmserzPgbfjtF88aCqFrdBJS+ixZo5KViNdUnlqmZV0UK/8bGYA9uK1b85SVYt9NZeulOoTVMcXg==", + "provenanceFile": "scanly-url-safety-2.1.0.tgz.sigstore.json", + "provenanceSha256": "30717ca382475727d43bd9fe08a9d3766901997bdf1c5393e98ec5e55c9f455a", + "purl": "pkg:npm/%40scanly/url-safety@2.1.0" + } + ] +} diff --git a/release/stable/v2.1.0/publication-recovery/build-B.json b/release/stable/v2.1.0/publication-recovery/build-B.json new file mode 100644 index 0000000..b9837c6 --- /dev/null +++ b/release/stable/v2.1.0/publication-recovery/build-B.json @@ -0,0 +1,150 @@ +{ + "schemaVersion": "scanly-v2.1-npm-build-1", + "version": "2.1.0", + "sourceCommit": "6b017b53a4404f4feab776ac111b0ea9dacf2734", + "sourceTree": "c72430a2ab0a2d47e7cd095325088f1e053a5c41", + "workflowDefinitionCommit": "e22d100163565164e2149f99ab54d11a6111932b", + "workflowRef": "Yangjunjie-Lin/Scanly/.github/workflows/v2.1-artifact-qualification.yml@refs/heads/codex/v2.1-npm-provenance-recovery", + "buildLabel": "B", + "runId": 34754673547, + "runAttempt": 1, + "invocationId": "https://github.com/Yangjunjie-Lin/Scanly/actions/runs/34754673547/attempts/1", + "nodeVersion": "v24.20.0", + "npmVersion": "11.12.1", + "repositoryDirty": false, + "published": false, + "artifacts": [ + { + "name": "@scanly/benchmark", + "version": "2.1.0", + "filename": "scanly-benchmark-2.1.0.tgz", + "size": 12489, + "sha256": "468b1cf37bf229029651fa1e6d6ec63414902578ea1f34b1f8632704ee47e9dd", + "sha512": "6e262c1f70df8cc03d30f8d096d7cf3fcfbaf392d5e9e7fea4ac3da4d3d098f95c9f064b6a75c738b49e984b4176b1e2b7a0d648e877bc6261962bcbec60d5cf", + "integrity": "sha512-biYsH3DfjMA9MPjQltfPP8+685LV6ef+pKw9pNPQmPlcnwZLanXHOLSemEtBdrHit6DWSOh3vGJhlivL7GDVzw==", + "provenanceFile": "scanly-benchmark-2.1.0.tgz.sigstore.json", + "provenanceSha256": "3f7cdd525bd73d8ae0c189053ffcc232015862d657f0ac82d2ece6f238ba7b9a", + "purl": "pkg:npm/%40scanly/benchmark@2.1.0" + }, + { + "name": "@scanly/browser", + "version": "2.1.0", + "filename": "scanly-browser-2.1.0.tgz", + "size": 112845, + "sha256": "c173f88dab2a0402ee549c9e609868c2b50145a8096ecc3c0c668a2823b92727", + "sha512": "07ffa207aa2a82609b0e808ae9221c3c773590406b3fe11dd45e4cf9840fc162170e42efda8d82ef72b39b9f33308e84db818a0239e563b37c66d008c768cf3e", + "integrity": "sha512-B/+iB6oqgmCbDoCK6SIcPHc1kEBrP+Ed1F5M+YQPwWIXDkLv2o2C73Kzm58zMI6E24GKAjnlY7N8ZtAIx2jPPg==", + "provenanceFile": "scanly-browser-2.1.0.tgz.sigstore.json", + "provenanceSha256": "fd1d643c44e53c18d448e639da02eca5684b980f4dec9d309316850a897ec1ca", + "purl": "pkg:npm/%40scanly/browser@2.1.0" + }, + { + "name": "@scanly/core", + "version": "2.1.0", + "filename": "scanly-core-2.1.0.tgz", + "size": 133351, + "sha256": "7a529c1c940ace1d961bd1df668f668623bcbac1527827579433efffeb10e416", + "sha512": "c6a81231287f8c9b7a7e30481f65d497496771b003d7d3114a0bc7cdec03baac801baa6c095978b91d77f48ec489a03205508289cdfcdee9b72a5e8ead10e2bd", + "integrity": "sha512-xqgSMSh/jJt6fjBIH2XUl0lncbAD19MRSgvHzewDuqyAG6psCVl4uR139I7EiaAyBVCCic383um3Kl6OrRDivQ==", + "provenanceFile": "scanly-core-2.1.0.tgz.sigstore.json", + "provenanceSha256": "686e2b5d3fce4ef890e0abf982a85ad2b860e5074c9347f427cd3b70fbd06dab", + "purl": "pkg:npm/%40scanly/core@2.1.0" + }, + { + "name": "@scanly/engine-jsqr", + "version": "2.1.0", + "filename": "scanly-engine-jsqr-2.1.0.tgz", + "size": 2737, + "sha256": "b530dcb7949290f068fa3dd3805c0ee23b26d4554cc920f058f1c6c6f3afc68b", + "sha512": "4550a7b56196e3f686de41cf278f9f28c9a9d57ccb6e6277a0ff707ecd8422c24d0ba53f63851d181b4b08b62026fc5d2b3191c522bc9c38d7745a0d58854d35", + "integrity": "sha512-RVCntWGW4/aG3kHPJ4+fKMmp1XzLbmJ3oP9wfs2EIsJNC6U/Y4UdGBtLCLYgJvxdKzGRxSK8nDjXdFoNWIVNNQ==", + "provenanceFile": "scanly-engine-jsqr-2.1.0.tgz.sigstore.json", + "provenanceSha256": "1d7bb45f10a318e2911e75802412e24b1d1e1eec477a491f35b2467acfe06b21", + "purl": "pkg:npm/%40scanly/engine-jsqr@2.1.0" + }, + { + "name": "@scanly/engine-zxing-cpp-wasm", + "version": "2.1.0", + "filename": "scanly-engine-zxing-cpp-wasm-2.1.0.tgz", + "size": 472873, + "sha256": "5215d8e09ff67ea07cececae51d34a975ae0396723ab235c627081568b1b796c", + "sha512": "46734c49cc0776b26edc1fa6261f78a028a6dd0ec97a7433cd22101648836faeba04c547e90510372fa7da4133d0303f85118cec2b17100581a160cb047bbc39", + "integrity": "sha512-RnNMScwHdrJu3B+mJh94oCim3Q7JenQzzSIQFkiDb666BMVH6QUQNy+n2kEz0DA/hRGM7CsXEAWBoWDLBHu8OQ==", + "provenanceFile": "scanly-engine-zxing-cpp-wasm-2.1.0.tgz.sigstore.json", + "provenanceSha256": "d3e591883cb3a7c92e22b08c851009a17adfe5e5645e7045aea4da7e81f5a5c5", + "purl": "pkg:npm/%40scanly/engine-zxing-cpp-wasm@2.1.0" + }, + { + "name": "@scanly/engine-zxing-js", + "version": "2.1.0", + "filename": "scanly-engine-zxing-js-2.1.0.tgz", + "size": 3188, + "sha256": "420c12ac6a7170c004cee7ce25af9e69f56165b1d50e31ebb1acf4eb03b2eecf", + "sha512": "49a7c63ddf6317b9662f1be45d92b8ea9289fbb51d4d364a5c1e3e899e82101afd268d26a8af25cb8a739bd4d213f23ea499d4cb5b00e95fff6dc7cfcf0d0fda", + "integrity": "sha512-SafGPd9jF7lmLxvkXZK46pKJ+7UdTTZKXB4+iZ6CEBr9Jo0mqK8ly4pzm9TSE/I+pJnUy1sA6V//bcfPzw0P2g==", + "provenanceFile": "scanly-engine-zxing-js-2.1.0.tgz.sigstore.json", + "provenanceSha256": "ace7b5a4fee1553aec49599231dd84b1622744356414b6df09f4d40325a9304e", + "purl": "pkg:npm/%40scanly/engine-zxing-js@2.1.0" + }, + { + "name": "@scanly/node", + "version": "2.1.0", + "filename": "scanly-node-2.1.0.tgz", + "size": 4163, + "sha256": "13207d6afba9038cf721bb9462ff096aedaa658ed22596c10f5529eb08fc3573", + "sha512": "88f404c159d400a4a03eff00294ad2076dc17dbc84b253c33fc8b742b975becc35d602e9fa529ff0ca91dc635148a8078d5564880973a63c49a2a7c6d1dc337e", + "integrity": "sha512-iPQEwVnUAKSgPv8AKUrSB23BfbyEslPDP8i3Qrl1vsw11gLp+lKf8MqR3GNRSKgHjVVkiAlzpjxJoqfG0dwzfg==", + "provenanceFile": "scanly-node-2.1.0.tgz.sigstore.json", + "provenanceSha256": "b71e17f7b53fc943b23cd92df8dd9220b6d33a2d5d8bd331ba4b892d86cbec53", + "purl": "pkg:npm/%40scanly/node@2.1.0" + }, + { + "name": "@scanly/parsers", + "version": "2.1.0", + "filename": "scanly-parsers-2.1.0.tgz", + "size": 5415, + "sha256": "2d71b9713d1b8d084b8c9bdeb0ffbe079b3df54a16488e50dabe857c374cb868", + "sha512": "1aa6833407e9d26ad02b160f253796e73d9517c5c9aa5d6d64795fccc37591f4d1997f443ff5ba34f0c05fea35c9bb217b23916f4b2418ef04f099a88b594755", + "integrity": "sha512-GqaDNAfp0mrQKxYPJTeW5z2VF8XJql1tZHlfzMN1kfTRmX9EP/W6NPDAX+o1ybsheyORb0skGO8E8Jmoi1lHVQ==", + "provenanceFile": "scanly-parsers-2.1.0.tgz.sigstore.json", + "provenanceSha256": "839823dca1ee698002dbfa39de7507ce8e8c6d53089801cae3a04c06722f9c29", + "purl": "pkg:npm/%40scanly/parsers@2.1.0" + }, + { + "name": "@scanly/react", + "version": "2.1.0", + "filename": "scanly-react-2.1.0.tgz", + "size": 2873, + "sha256": "e709ec6f963a91f593a55efcda65e5cf524774154496a1011d8474bb7ab9b8ff", + "sha512": "8c2b8ee908aa097ce7c132a4fbd3671e1264665ed4cd34a7de3cc52188e800acbd2dd8d255cdb10f786b68638310d8301a11fb6c8c71b7e080bda88741f0a497", + "integrity": "sha512-jCuO6QiqCXznwTKk+9NnHhJkZl7UzTSn3jzFIYjoAKy9LdjSVc2xD3hraGODENgwGhH7bIxxt+CAvaiHQfCklw==", + "provenanceFile": "scanly-react-2.1.0.tgz.sigstore.json", + "provenanceSha256": "e88519b2bef24d11b953a4c7e9c6c6670f7b9038a63abc62e17213cce1da9e2c", + "purl": "pkg:npm/%40scanly/react@2.1.0" + }, + { + "name": "@scanly/scenario-schema", + "version": "2.1.0", + "filename": "scanly-scenario-schema-2.1.0.tgz", + "size": 10376, + "sha256": "b55e951e1fcd5e129200beab60ee057dee23d4694409df75d007c0953a7e90b1", + "sha512": "973fc3a387a978f8f52e63a82f574cf829c2bdd12bb5b0ad7f5766206e8610269d0e69aae90eb45f560f794a9223f9422010d54bc8a40e82ae32c027468eddbe", + "integrity": "sha512-lz/Do4epePj1LmOoL1dM+CnCvdErtbCtf1dmIG6GECadDmmq6Q60X1YPeUqSI/lCIBDVS8ikDoKuMsAnRo7dvg==", + "provenanceFile": "scanly-scenario-schema-2.1.0.tgz.sigstore.json", + "provenanceSha256": "50be2740712a76e80ee0059dc57b0a3f73a90b8072cc20b6e99a8c8f0abc0e0d", + "purl": "pkg:npm/%40scanly/scenario-schema@2.1.0" + }, + { + "name": "@scanly/url-safety", + "version": "2.1.0", + "filename": "scanly-url-safety-2.1.0.tgz", + "size": 35468, + "sha256": "72bbd5974b2a0b0c2c1ded6098c249084df0fbffe50a937ef96e68902b914a87", + "sha512": "269e2f2ed7dbb71926b1eaf33e06df8ed17cf1a0aa16b741252fa2c59a3929588d7549e5aa6655d142bff1b19803db8ad5bf3949562df4d65eba53a84d531c5e", + "integrity": "sha512-Jp4vLtfbtxkmserzPgbfjtF88aCqFrdBJS+ixZo5KViNdUnlqmZV0UK/8bGYA9uK1b85SVYt9NZeulOoTVMcXg==", + "provenanceFile": "scanly-url-safety-2.1.0.tgz.sigstore.json", + "provenanceSha256": "bb9366faafef9d3541c0129facc15e66a3d56ca8ee20c676add6275872a1921b", + "purl": "pkg:npm/%40scanly/url-safety@2.1.0" + } + ] +} diff --git a/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-benchmark-2.1.0.tgz.sigstore.json b/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-benchmark-2.1.0.tgz.sigstore.json new file mode 100644 index 0000000..31ccee3 --- /dev/null +++ b/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-benchmark-2.1.0.tgz.sigstore.json @@ -0,0 +1,61 @@ +{ + "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", + "verificationMaterial": { + "certificate": { + "rawBytes": "MIIILDCCB7KgAwIBAgIUBIYFtfYqdrs2mSqnw3OQg8EJ3hwwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTEzMTEzMjQ1WhcNMjYwOTEzMTE0MjQ1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY0lQrpmPsJDwlnaYHx8Ld/BxQ89khirOzZgwyPGTlEhOVLWXygd2x2rS1ghyVA9YPYBWU8sr4XXoP8XHTYpjsKOCBtEwggbNMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUg6s5BZ0YUaQo/zUxw9iiUmmiqmYwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wgZkGA1UdEQEB/wSBjjCBi4aBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAfBgorBgEEAYO/MAECBBF3b3JrZmxvd19kaXNwYXRjaDA2BgorBgEEAYO/MAEDBChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCkGCisGAQQBg78wAQQEG3YyLjEgQXJ0aWZhY3QgUXVhbGlmaWNhdGlvbjAjBgorBgEEAYO/MAEFBBVZYW5nanVuamllLUxpbi9TY2FubHkwOwYKKwYBBAGDvzABBgQtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTCBmgYKKwYBBAGDvzABCQSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABCgQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMB0GCisGAQQBg78wAQsEDwwNZ2l0aHViLWhvc3RlZDA4BgorBgEEAYO/MAEMBCoMKGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkwOAYKKwYBBAGDvzABDQQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMD0GCisGAQQBg78wAQ4ELwwtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MBoGCisGAQQBg78wAQ8EDAwKMTE1NjM0MjY1MzAxBgorBgEEAYO/MAEQBCMMIWh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbjAZBgorBgEEAYO/MAERBAsMCTIyNDM3MDg5ODCBmgYKKwYBBAGDvzABEgSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABEwQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCEGCisGAQQBg78wARQEEwwRd29ya2Zsb3dfZGlzcGF0Y2gwXAYKKwYBBAGDvzABFQRODExodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5L2FjdGlvbnMvcnVucy8zNDc1NDY3MzU0Ny9hdHRlbXB0cy8xMBYGCisGAQQBg78wARYECAwGcHVibGljMFwGCisGAQQBg78wARgETgxMcmVwbzpZYW5nanVuamllLUxpbi9TY2FubHk6cmVmOnJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeTCBigYKKwYBBAHWeQIEAgR8BHoAeAB2AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABoJqKiiQAAAQDAEcwRQIgcOsDHbFGKeBiqVXemzh2zoU8lO3dhcwNCFMEL9dC9nYCIQCt/dyowdbkERCy+5sJdg5ifxbiFGNF//cUg6jxPItgCDAKBggqhkjOPQQDAwNoADBlAjAtfyQaW4OcppF9hRwWtTEfGlYEz3lJoXUss8E95COH8GvM6DgYMooQAJWSHlzMad0CMQDbOJ/pfS3PMZrUpRnxMceRMpfdNS/nP2Te8PGz9KIxYVeELz724JpttFkU0JYtvKA=" + }, + "tlogEntries": [ + { + "logIndex": "2817433184", + "logId": { + "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=" + }, + "kindVersion": { + "kind": "dsse", + "version": "0.0.1" + }, + "integratedTime": "1789299165", + "inclusionPromise": { + "signedEntryTimestamp": "MEYCIQCHGFuY6Z9kLYXKOdrz1t3pAjbzNCqAYarPG1qptpuGOwIhAIRI6iVabPT6sjzPccArhJVmVtnU7TO6sSrAlhaA+JbP" + }, + "inclusionProof": { + "logIndex": "2695528922", + "rootHash": "BFbjp9bDdKXrwqfkhdxNKiMcXKAUYvCuGm8G95wjuoA=", + "treeSize": "2695528931", + "hashes": [ + "eggyGmEZYRMpefw2PXQB2bZldB+wOc05/GyGOtOB2Yc=", + "Ich6SPQfmVeVrXU2TYOOcyN0nFnQYTGw3CoP6cdmIek=", + "dZFrI+J+O7nw7d2LLnOrrCp+6tHtd3CobGoCeBXYvU4=", + "Ksc2QZXcouaFu8JosXyw/pU+Pvh+WYvc2uEIfwq5mc0=", + "Gp3TfPYi7IAWTXl1n1v0HQV8z7+CUbywpxL7FmNwjLk=", + "vFOL9ITbCHBOJayiXef4ImMlZYGX0p2LRTmvWZHmutY=", + "TS5hjP9fX6vL1lIjz4e1Pa+Ah94bVp50FYQkbMtODis=", + "WkVhje8zTL7coFa3ix6k4E6CX6fA9yRq+GYza7kaljg=", + "eC7F0a1fX4FFQD8HBsDNjwogHfJ/3faoxQM2Sq3vNRM=", + "99PoJTYgPWevn9oVlADbWdRGR90JL8Fx/FV0T06o0IA=", + "LQtwekqXPoO3KgXYEfRsV0WYK6Gk0PLLePxJWdZgThQ=", + "qOZd1StyLttRdZ9ojwet4/yO1QqFuSN2bQKQaTXLrkY=", + "uXYCZMF7lS28YUWZqw7VfMV5vdtFS6j7/bavDJtBebk=", + "S39m2eTD1rqRuAMs4r+sGsYIwW0BlTWuysWTKJ8RKVk=", + "qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=", + "xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY=" + ], + "checkpoint": { + "envelope": "rekor.sigstore.dev - 1193050959916656506\n2695528931\nBFbjp9bDdKXrwqfkhdxNKiMcXKAUYvCuGm8G95wjuoA=\n\n— rekor.sigstore.dev wNI9ajBFAiBhh3v2md9QOPBRvjnUMCfIsbs2PSSY6zLwhyKrzT1W7QIhAMeQ5FVC1RvHW8BxCz+smDFtZ4SWIxH6sOjxzJLi7gfp\n" + } + }, + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiZjNjYjRiOGE1YTkzZmQwYmY5ZjgyNDVhYWU4ZTMxNTQ3NTY3ZTllZGU4ZmI1N2Q1ZGQ5MWQ0OTliYWNmZmNmMyJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjM5YjQ5ZTBjYjQ3NTllNzA5OWI1N2YyNzBlNmNmMTljZWZmOWNjYTJiMWI0NmNjYmRiNTNiNjM5NWUyNDg5YzcifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVVQ0lRRDdNYU1ZWDdOS2RHOU1US3luVjlIblJNdmhuakFWdlUwckw2c1NyRElIT0FJZ0hNSkZkSVROblZCZ3ZqMHhjdXhmKzZ6YW9GWXgzbndxNThVc1B6ZHp1YUE9IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VsTVJFTkRRamRMWjBGM1NVSkJaMGxWUWtsWlJuUm1XWEZrY25NeWJWTnhibmN6VDFGbk9FVktNMmgzZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwOVVSWHBOVkVWNlRXcFJNVmRvWTA1TmFsbDNUMVJGZWsxVVJUQk5hbEV4VjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVlpNR3hSY25CdFVITktSSGRzYm1GWlNIZzRUR1F2UW5oUk9EbHJhR2x5VDNwYVozY0tlVkJIVkd4RmFFOVdURmRZZVdka01uZ3ljbE14WjJoNVZrRTVXVkJaUWxkVk9ITnlORmhZYjFBNFdFaFVXWEJxYzB0UFEwSjBSWGRuWjJKT1RVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVm5Obk0xQ2tKYU1GbFZZVkZ2TDNwVmVIYzVhV2xWYlcxcGNXMVpkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMmRhYTBkQk1WVmtSVkZGUWk5M1UwSnFha05DYVRSaFFtbEhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RRcGhiV3hzVEZWNGNHSnBPVlJaTWtaMVlraHJka3h0WkhCa1IyZ3hXV2s1TTJJelNuSmFiWGgyWkROTmRtUnFTWFZOVXpGb1kyNVNjRnB0Um1wa1F6RjRDbVJYUm5OaFYxcHdXVEpHTUdGWE9YVk1ibXgwWWtWQ2VWcFhXbnBNTW1oc1dWZFNla3d5VG5aYVIxWTBURE5aZVV4cVJYUmlia0owVEZoQ2VXSXpXbXdLWW0xR2RWa3lWWFJqYlZacVlqTmFiR051YTNkUFVWbExTM2RaUWtKQlIwUjJla0ZDUVZGUmNtRklVakJqU0UwMlRIazVNR0l5ZEd4aWFUVm9XVE5TY0FwaU1qVjZURzFrY0dSSGFERlpibFo2V2xoS2FtSXlOVEJhVnpVd1RHMU9kbUpVUVdaQ1oyOXlRbWRGUlVGWlR5OU5RVVZEUWtKR00ySXpTbkphYlhoMkNtUXhPV3RoV0U1M1dWaFNhbUZFUVRKQ1oyOXlRbWRGUlVGWlR5OU5RVVZFUWtOb2JFMXFTbXROVkVGM1RWUlplazVVV1RGTlZGa3dXbFJKZUU1RWJHMEtUMVJzYUZscVZUQmFSRVY0V1ZSWmVFMVVSVFZOZWtwcFRVTnJSME5wYzBkQlVWRkNaemM0ZDBGUlVVVkhNMWw1VEdwRloxRllTakJoVjFwb1dUTlJad3BWV0Zab1lrZHNiV0ZYVG1oa1IyeDJZbXBCYWtKbmIzSkNaMFZGUVZsUEwwMUJSVVpDUWxaYVdWYzFibUZ1Vm5WaGJXeHNURlY0Y0dKcE9WUlpNa1oxQ21KSWEzZFBkMWxMUzNkWlFrSkJSMFIyZWtGQ1FtZFJkR050Vm0xamVUbHZXbGRHYTJONU9XcGlNbEpzWlVNNU1rMXBOSGhNVnpWM1lsTXhkMk50T1RJS1dsYzFhR0p0VG14TVdFcHNXVEk1TWxwWVNqVk5SSE5IUTJselIwRlJVVUpuTnpoM1FWRm5SVXhSZDNKaFNGSXdZMGhOTmt4NU9UQmlNblJzWW1rMWFBcFpNMUp3WWpJMWVreHRaSEJrUjJneFdXNVdlbHBZU21waU1qVXdXbGMxTUV4dFRuWmlWRU5DYldkWlMwdDNXVUpDUVVkRWRucEJRa05SVTBKcGQzbENDbWxIYURCa1NFSjZUMms0ZGxveWJEQmhTRlpwVEcxT2RtSlRPVnBaVnpWdVlXNVdkV0Z0Ykd4TVZYaHdZbWs1VkZreVJuVmlTR3QyVEcxa2NHUkhhREVLV1drNU0ySXpTbkphYlhoMlpETk5kbVJxU1hWTlV6Rm9ZMjVTY0ZwdFJtcGtRekY0WkZkR2MyRlhXbkJaTWtZd1lWYzVkVXh1YkhSaVJVSjVXbGRhZWdwTU1taHNXVmRTZWt3eVRuWmFSMVkwVEROWmVVeHFSWFJpYmtKMFRGaENlV0l6V214aWJVWjFXVEpWZEdOdFZtcGlNMXBzWTI1cmQwOUJXVXRMZDFsQ0NrSkJSMFIyZWtGQ1EyZFJjVVJEYUd4TmFrcHJUVlJCZDAxVVdYcE9WRmt4VFZSWk1GcFVTWGhPUkd4dFQxUnNhRmxxVlRCYVJFVjRXVlJaZUUxVVJUVUtUWHBLYVUxQ01FZERhWE5IUVZGUlFtYzNPSGRCVVhORlJIZDNUbG95YkRCaFNGWnBURmRvZG1NelVteGFSRUUwUW1kdmNrSm5SVVZCV1U4dlRVRkZUUXBDUTI5TlMwZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNVdsbFhOVzVoYmxaMVlXMXNiRXhWZUhCaWFUbFVXVEpHZFdKSWEzZFBRVmxMQ2t0M1dVSkNRVWRFZG5wQlFrUlJVWEZFUTJoc1RXcEthMDFVUVhkTlZGbDZUbFJaTVUxVVdUQmFWRWw0VGtSc2JVOVViR2haYWxVd1drUkZlRmxVV1hnS1RWUkZOVTE2U21sTlJEQkhRMmx6UjBGUlVVSm5OemgzUVZFMFJVeDNkM1JqYlZadFkzazViMXBYUm10amVUbHFZakpTYkdWRE9USk5hVFI0VEZjMWR3cGlVekYzWTIwNU1scFhOV2hpYlU1c1RGaEtiRmt5T1RKYVdFbzFUVUp2UjBOcGMwZEJVVkZDWnpjNGQwRlJPRVZFUVhkTFRWUkZNVTVxVFRCTmFsa3hDazE2UVhoQ1oyOXlRbWRGUlVGWlR5OU5RVVZSUWtOTlRVbFhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnFRVnBDWjI5eVFtZEZSVUZaVHk5TlFVVlNRa0Z6VFVOVVNYbE9SRTB6VFVSbk5VOUVRMEp0WjFsTFMzZFpRa0pCUjBSMmVrRkNSV2RUUWdwcGQzbENhVWRvTUdSSVFucFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVXbGxYTlc1aGJsWjFZVzFzYkV4VmVIQmlhVGxVV1RKR2RXSklhM1pNYldSd0NtUkhhREZaYVRrellqTktjbHB0ZUhaa00wMTJaR3BKZFUxVE1XaGpibEp3V20xR2FtUkRNWGhrVjBaellWZGFjRmt5UmpCaFZ6bDFURzVzZEdKRlFua0tXbGRhZWt3eWFHeFpWMUo2VERKT2RscEhWalJNTTFsNVRHcEZkR0p1UW5STVdFSjVZak5hYkdKdFJuVlpNbFYwWTIxV2FtSXpXbXhqYm10M1QwRlpTd3BMZDFsQ1FrRkhSSFo2UVVKRmQxRnhSRU5vYkUxcVNtdE5WRUYzVFZSWmVrNVVXVEZOVkZrd1dsUkplRTVFYkcxUFZHeG9XV3BWTUZwRVJYaFpWRmw0Q2sxVVJUVk5la3BwVFVORlIwTnBjMGRCVVZGQ1p6YzRkMEZTVVVWRmQzZFNaREk1ZVdFeVduTmlNMlJtV2tkc2VtTkhSakJaTW1kM1dFRlpTMHQzV1VJS1FrRkhSSFo2UVVKR1VWSlBSRVY0YjJSSVVuZGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbGRYUm5WYU1uQXhZbTF3Y0ZwVE1VMWhWelIyVlRKT2FBcGliWGcxVERKR2FtUkhiSFppYmsxMlkyNVdkV041T0hwT1JHTXhUa1JaTTAxNlZUQk9lVGxvWkVoU2JHSllRakJqZVRoNFRVSlpSME5wYzBkQlVWRkNDbWMzT0hkQlVsbEZRMEYzUjJOSVZtbGlSMnhxVFVaM1IwTnBjMGRCVVZGQ1p6YzRkMEZTWjBWVVozaE5ZMjFXZDJKNmNGcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnBPVlJaTWtaMVlraHJObU50Vm0xUGJrcHNXbTVOZG1GSFZtaGFTRTEyV1RJNWExcFlaM1prYWtsMVRWTXhkV05ITUhSalNFcDJaRzFXZFFwWlZ6VnFXbE14ZVZwWFRuWmtiVlo1WlZSRFFtbG5XVXRMZDFsQ1FrRklWMlZSU1VWQloxSTRRa2h2UVdWQlFqSkJUakE1VFVkeVIzaDRSWGxaZUd0bENraEtiRzVPZDB0cFUydzJORE5xZVhRdk5HVkxZMjlCZGt0bE5rOUJRVUZDYjBweFMybHBVVUZCUVZGRVFVVmpkMUpSU1dkalQzTkVTR0pHUjB0bFFta0tjVlpZWlcxNmFESjZiMVU0YkU4elpHaGpkMDVEUmsxRlREbGtRemx1V1VOSlVVTjBMMlI1YjNka1ltdEZVa041S3pWelNtUm5OV2xtZUdKcFJrZE9SZ292TDJOVlp6WnFlRkJKZEdkRFJFRkxRbWRuY1docmFrOVFVVkZFUVhkT2IwRkVRbXhCYWtGMFpubFJZVmMwVDJOd2NFWTVhRkozVjNSVVJXWkhiRmxGQ25vemJFcHZXRlZ6Y3poRk9UVkRUMGc0UjNaTk5rUm5XVTF2YjFGQlNsZFRTR3g2VFdGa01FTk5VVVJpVDBvdmNHWlRNMUJOV25KVmNGSnVlRTFqWlZJS1RYQm1aRTVUTDI1UU1sUmxPRkJIZWpsTFNYaFpWbVZGVEhvM01qUktjSFIwUm10Vk1FcFpkSFpMUVQwS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9XX19" + } + ], + "timestampVerificationData": {} + }, + "dsseEnvelope": { + "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoicGtnOm5wbS8lNDBzY2FubHkvYmVuY2htYXJrQDIuMS4wIiwiZGlnZXN0Ijp7InNoYTUxMiI6IjZlMjYyYzFmNzBkZjhjYzAzZDMwZjhkMDk2ZDdjZjNmY2ZiYWYzOTJkNWU5ZTdmZWE0YWMzZGE0ZDNkMDk4Zjk1YzlmMDY0YjZhNzVjNzM4YjQ5ZTk4NGI0MTc2YjFlMmI3YTBkNjQ4ZTg3N2JjNjI2MTk2MmJjYmVjNjBkNWNmIn19XSwicHJlZGljYXRlVHlwZSI6Imh0dHBzOi8vc2xzYS5kZXYvcHJvdmVuYW5jZS92MSIsInByZWRpY2F0ZSI6eyJidWlsZERlZmluaXRpb24iOnsiYnVpbGRUeXBlIjoiaHR0cHM6Ly9zbHNhLWZyYW1ld29yay5naXRodWIuaW8vZ2l0aHViLWFjdGlvbnMtYnVpbGR0eXBlcy93b3JrZmxvdy92MSIsImV4dGVybmFsUGFyYW1ldGVycyI6eyJ3b3JrZmxvdyI6eyJyZWYiOiJyZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkiLCJyZXBvc2l0b3J5IjoiaHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seSIsInBhdGgiOiIuZ2l0aHViL3dvcmtmbG93cy92Mi4xLWFydGlmYWN0LXF1YWxpZmljYXRpb24ueW1sIn0sInNvdXJjZV9jb21taXQiOiI2YjAxN2I1M2E0NDA0ZjRmZWFiNzc2YWMxMTFiMGVhOWRhY2YyNzM0In0sImludGVybmFsUGFyYW1ldGVycyI6eyJnaXRodWIiOnsiZXZlbnRfbmFtZSI6IndvcmtmbG93X2Rpc3BhdGNoIiwicmVwb3NpdG9yeV9pZCI6IjExNTYzNDI2NTMiLCJyZXBvc2l0b3J5X293bmVyX2lkIjoiMjI0MzcwODk4In19LCJyZXNvbHZlZERlcGVuZGVuY2llcyI6W3sidXJpIjoiZ2l0K2h0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHlAcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5IiwiZGlnZXN0Ijp7ImdpdENvbW1pdCI6ImUyMmQxMDAxNjM1NjUxNjRlMjE0OWY5OWFiNTRkMTFhNjExMTkzMmIifX0seyJ1cmkiOiJnaXQraHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seUA2YjAxN2I1M2E0NDA0ZjRmZWFiNzc2YWMxMTFiMGVhOWRhY2YyNzM0IiwiZGlnZXN0Ijp7ImdpdENvbW1pdCI6IjZiMDE3YjUzYTQ0MDRmNGZlYWI3NzZhYzExMWIwZWE5ZGFjZjI3MzQifX1dfSwicnVuRGV0YWlscyI6eyJidWlsZGVyIjp7ImlkIjoiaHR0cHM6Ly9naXRodWIuY29tL2FjdGlvbnMvcnVubmVyL2dpdGh1Yi1ob3N0ZWQifSwibWV0YWRhdGEiOnsiaW52b2NhdGlvbklkIjoiaHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seS9hY3Rpb25zL3J1bnMvMzQ3NTQ2NzM1NDcvYXR0ZW1wdHMvMSJ9fX19", + "payloadType": "application/vnd.in-toto+json", + "signatures": [ + { + "sig": "MEUCIQD7MaMYX7NKdG9MTKynV9HnRMvhnjAVvU0rL6sSrDIHOAIgHMJFdITNnVBgvj0xcuxf+6zaoFYx3nwq58UsPzdzuaA=" + } + ] + } +} diff --git a/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-browser-2.1.0.tgz.sigstore.json b/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-browser-2.1.0.tgz.sigstore.json new file mode 100644 index 0000000..8600eb1 --- /dev/null +++ b/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-browser-2.1.0.tgz.sigstore.json @@ -0,0 +1,60 @@ +{ + "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", + "verificationMaterial": { + "certificate": { + "rawBytes": "MIIILDCCB7KgAwIBAgIULkW3dAMr7Dq86oYxZShIoPAbmkkwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTEzMTEzMjQ2WhcNMjYwOTEzMTE0MjQ2WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEFTmCe1q0ZnKBY6IBQGmT5yiumJz0VWNtufjon4kd4YWYnpV4s7f3IVzh1kiQAFFI1pC5z49Ii0GPlv71MKparKOCBtEwggbNMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUtKDyDNjL3E8dzzvt9rydzAqq7T8wHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wgZkGA1UdEQEB/wSBjjCBi4aBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAfBgorBgEEAYO/MAECBBF3b3JrZmxvd19kaXNwYXRjaDA2BgorBgEEAYO/MAEDBChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCkGCisGAQQBg78wAQQEG3YyLjEgQXJ0aWZhY3QgUXVhbGlmaWNhdGlvbjAjBgorBgEEAYO/MAEFBBVZYW5nanVuamllLUxpbi9TY2FubHkwOwYKKwYBBAGDvzABBgQtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTCBmgYKKwYBBAGDvzABCQSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABCgQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMB0GCisGAQQBg78wAQsEDwwNZ2l0aHViLWhvc3RlZDA4BgorBgEEAYO/MAEMBCoMKGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkwOAYKKwYBBAGDvzABDQQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMD0GCisGAQQBg78wAQ4ELwwtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MBoGCisGAQQBg78wAQ8EDAwKMTE1NjM0MjY1MzAxBgorBgEEAYO/MAEQBCMMIWh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbjAZBgorBgEEAYO/MAERBAsMCTIyNDM3MDg5ODCBmgYKKwYBBAGDvzABEgSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABEwQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCEGCisGAQQBg78wARQEEwwRd29ya2Zsb3dfZGlzcGF0Y2gwXAYKKwYBBAGDvzABFQRODExodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5L2FjdGlvbnMvcnVucy8zNDc1NDY3MzU0Ny9hdHRlbXB0cy8xMBYGCisGAQQBg78wARYECAwGcHVibGljMFwGCisGAQQBg78wARgETgxMcmVwbzpZYW5nanVuamllLUxpbi9TY2FubHk6cmVmOnJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeTCBigYKKwYBBAHWeQIEAgR8BHoAeAB2AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABoJqKju4AAAQDAEcwRQIhAIi4p1AsyxkWd+WvaCud8B+J0qt5FCx6f4hFk1OZ8/aWAiBJYU+E1xYNwjvtIXVt3BEN0YCyezZCCnUGvZ2Kpjih0zAKBggqhkjOPQQDAwNoADBlAjEAg/TtYtDt1whR5KFSJVDKlu7Bn7fqOkqGVLk8ojK5C2fPqzQzsXHRhqpm2vrr3hTCAjBZP+P3+Wzkv2xIiOvxUP/gI6iwfZJCtlrofXDYU82y4FNtUfzFwl+6tIOrrUTFrkc=" + }, + "tlogEntries": [ + { + "logIndex": "2817433305", + "logId": { + "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=" + }, + "kindVersion": { + "kind": "dsse", + "version": "0.0.1" + }, + "integratedTime": "1789299167", + "inclusionPromise": { + "signedEntryTimestamp": "MEYCIQDkR70MmLwckoOyNBi/vssf1Ctm2TOVGHYvhcLNpa1XvwIhAPVQetZW9AsQ60oOlkHCJxkWAZ5MLk6HHBkjYGtDWBHU" + }, + "inclusionProof": { + "logIndex": "2695529043", + "rootHash": "hz5pd6xlkIN8c065EQJRMTAQVwQmYJPvXqYF34sBMVE=", + "treeSize": "2695529063", + "hashes": [ + "d64gHcLE6bU116vXAtX9oJfTV5gOn2Z6fE+hNXLQjxU=", + "/b/3rsrIdMj4lwj0dTHCMGes9UH/rMeM1EcTvcxMzMg=", + "yOy7XNC06nwe7TqR6h0zhmHY/l+4DC0wMMF6SiobHUg=", + "2ANfVzCD0UnmNWif2KUfr6dyw7h7SOKGu+vm2iryn3I=", + "Hqis8qq24rEHYEWNCWHRHSkgHk6NZ318TC6uGdWj4/s=", + "bmb7gvv1jafKS/v0j4/buVC6JiJybUkbBkiNRnPiJAA=", + "H27YRNXOUnKHYH7yIqPw/rTiGorrcmx/LFYfxPD/j5U=", + "JB/RNmp6kfQ4AFK/yjP1W28cn5xu4p4PvAGOfnm1q5c=", + "99PoJTYgPWevn9oVlADbWdRGR90JL8Fx/FV0T06o0IA=", + "LQtwekqXPoO3KgXYEfRsV0WYK6Gk0PLLePxJWdZgThQ=", + "qOZd1StyLttRdZ9ojwet4/yO1QqFuSN2bQKQaTXLrkY=", + "uXYCZMF7lS28YUWZqw7VfMV5vdtFS6j7/bavDJtBebk=", + "S39m2eTD1rqRuAMs4r+sGsYIwW0BlTWuysWTKJ8RKVk=", + "qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=", + "xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY=" + ], + "checkpoint": { + "envelope": "rekor.sigstore.dev - 1193050959916656506\n2695529063\nhz5pd6xlkIN8c065EQJRMTAQVwQmYJPvXqYF34sBMVE=\n\n— rekor.sigstore.dev wNI9ajBFAiAz7H9R/+fZOskwhlMhF9JD5pfEg4RtJqqFhzXGogkyOAIhAJmBOJiblbXqlpuUCqs/O3CBIObMcKoum874SOXgAla5\n" + } + }, + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiYzUwZGFhMDU4NDI3ZTExZTVhY2ViNzVkOWZlYmIyNzExNjg3NWY5N2JjNTVmNmE2ODY4YWUyNmNjYTE5MzI2NiJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImM3OWI4NThhMjAxYmM3NjQzOGIxYTZmMWQ1YjQzMDNkNWY2ZGNhMzY2MTBhNjkwOTQwZWZiODBlZDM0MTQxOWMifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVRQ0lGa0hnWWhKSzhKbHpBeGN0VURnSERJUVZTbFEzRFJvVU9TM2s5alZ1UGRsQWlCM2c2cUFheVhVVWF0dndWY0lWWmhtdXNWNnZUcXBHajZ1a2FnU0ZVeXBtQT09IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VsTVJFTkRRamRMWjBGM1NVSkJaMGxWVEd0WE0yUkJUWEkzUkhFNE5tOVplRnBUYUVsdlVFRmliV3RyZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwOVVSWHBOVkVWNlRXcFJNbGRvWTA1TmFsbDNUMVJGZWsxVVJUQk5hbEV5VjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVkdWRzFEWlRGeE1GcHVTMEpaTmtsQ1VVZHRWRFY1YVhWdFNub3dWbGRPZEhWbWFtOEtialJyWkRSWlYxbHVjRlkwY3pkbU0wbFdlbWd4YTJsUlFVWkdTVEZ3UXpWNk5EbEphVEJIVUd4Mk56Rk5TM0JoY2t0UFEwSjBSWGRuWjJKT1RVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVjBTMFI1Q2tST2Frd3pSVGhrZW5wMmREbHllV1I2UVhGeE4xUTRkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMmRhYTBkQk1WVmtSVkZGUWk5M1UwSnFha05DYVRSaFFtbEhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RRcGhiV3hzVEZWNGNHSnBPVlJaTWtaMVlraHJka3h0WkhCa1IyZ3hXV2s1TTJJelNuSmFiWGgyWkROTmRtUnFTWFZOVXpGb1kyNVNjRnB0Um1wa1F6RjRDbVJYUm5OaFYxcHdXVEpHTUdGWE9YVk1ibXgwWWtWQ2VWcFhXbnBNTW1oc1dWZFNla3d5VG5aYVIxWTBURE5aZVV4cVJYUmlia0owVEZoQ2VXSXpXbXdLWW0xR2RWa3lWWFJqYlZacVlqTmFiR051YTNkUFVWbExTM2RaUWtKQlIwUjJla0ZDUVZGUmNtRklVakJqU0UwMlRIazVNR0l5ZEd4aWFUVm9XVE5TY0FwaU1qVjZURzFrY0dSSGFERlpibFo2V2xoS2FtSXlOVEJhVnpVd1RHMU9kbUpVUVdaQ1oyOXlRbWRGUlVGWlR5OU5RVVZEUWtKR00ySXpTbkphYlhoMkNtUXhPV3RoV0U1M1dWaFNhbUZFUVRKQ1oyOXlRbWRGUlVGWlR5OU5RVVZFUWtOb2JFMXFTbXROVkVGM1RWUlplazVVV1RGTlZGa3dXbFJKZUU1RWJHMEtUMVJzYUZscVZUQmFSRVY0V1ZSWmVFMVVSVFZOZWtwcFRVTnJSME5wYzBkQlVWRkNaemM0ZDBGUlVVVkhNMWw1VEdwRloxRllTakJoVjFwb1dUTlJad3BWV0Zab1lrZHNiV0ZYVG1oa1IyeDJZbXBCYWtKbmIzSkNaMFZGUVZsUEwwMUJSVVpDUWxaYVdWYzFibUZ1Vm5WaGJXeHNURlY0Y0dKcE9WUlpNa1oxQ21KSWEzZFBkMWxMUzNkWlFrSkJSMFIyZWtGQ1FtZFJkR050Vm0xamVUbHZXbGRHYTJONU9XcGlNbEpzWlVNNU1rMXBOSGhNVnpWM1lsTXhkMk50T1RJS1dsYzFhR0p0VG14TVdFcHNXVEk1TWxwWVNqVk5SSE5IUTJselIwRlJVVUpuTnpoM1FWRm5SVXhSZDNKaFNGSXdZMGhOTmt4NU9UQmlNblJzWW1rMWFBcFpNMUp3WWpJMWVreHRaSEJrUjJneFdXNVdlbHBZU21waU1qVXdXbGMxTUV4dFRuWmlWRU5DYldkWlMwdDNXVUpDUVVkRWRucEJRa05SVTBKcGQzbENDbWxIYURCa1NFSjZUMms0ZGxveWJEQmhTRlpwVEcxT2RtSlRPVnBaVnpWdVlXNVdkV0Z0Ykd4TVZYaHdZbWs1VkZreVJuVmlTR3QyVEcxa2NHUkhhREVLV1drNU0ySXpTbkphYlhoMlpETk5kbVJxU1hWTlV6Rm9ZMjVTY0ZwdFJtcGtRekY0WkZkR2MyRlhXbkJaTWtZd1lWYzVkVXh1YkhSaVJVSjVXbGRhZWdwTU1taHNXVmRTZWt3eVRuWmFSMVkwVEROWmVVeHFSWFJpYmtKMFRGaENlV0l6V214aWJVWjFXVEpWZEdOdFZtcGlNMXBzWTI1cmQwOUJXVXRMZDFsQ0NrSkJSMFIyZWtGQ1EyZFJjVVJEYUd4TmFrcHJUVlJCZDAxVVdYcE9WRmt4VFZSWk1GcFVTWGhPUkd4dFQxUnNhRmxxVlRCYVJFVjRXVlJaZUUxVVJUVUtUWHBLYVUxQ01FZERhWE5IUVZGUlFtYzNPSGRCVVhORlJIZDNUbG95YkRCaFNGWnBURmRvZG1NelVteGFSRUUwUW1kdmNrSm5SVVZCV1U4dlRVRkZUUXBDUTI5TlMwZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNVdsbFhOVzVoYmxaMVlXMXNiRXhWZUhCaWFUbFVXVEpHZFdKSWEzZFBRVmxMQ2t0M1dVSkNRVWRFZG5wQlFrUlJVWEZFUTJoc1RXcEthMDFVUVhkTlZGbDZUbFJaTVUxVVdUQmFWRWw0VGtSc2JVOVViR2haYWxVd1drUkZlRmxVV1hnS1RWUkZOVTE2U21sTlJEQkhRMmx6UjBGUlVVSm5OemgzUVZFMFJVeDNkM1JqYlZadFkzazViMXBYUm10amVUbHFZakpTYkdWRE9USk5hVFI0VEZjMWR3cGlVekYzWTIwNU1scFhOV2hpYlU1c1RGaEtiRmt5T1RKYVdFbzFUVUp2UjBOcGMwZEJVVkZDWnpjNGQwRlJPRVZFUVhkTFRWUkZNVTVxVFRCTmFsa3hDazE2UVhoQ1oyOXlRbWRGUlVGWlR5OU5RVVZSUWtOTlRVbFhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnFRVnBDWjI5eVFtZEZSVUZaVHk5TlFVVlNRa0Z6VFVOVVNYbE9SRTB6VFVSbk5VOUVRMEp0WjFsTFMzZFpRa0pCUjBSMmVrRkNSV2RUUWdwcGQzbENhVWRvTUdSSVFucFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVXbGxYTlc1aGJsWjFZVzFzYkV4VmVIQmlhVGxVV1RKR2RXSklhM1pNYldSd0NtUkhhREZaYVRrellqTktjbHB0ZUhaa00wMTJaR3BKZFUxVE1XaGpibEp3V20xR2FtUkRNWGhrVjBaellWZGFjRmt5UmpCaFZ6bDFURzVzZEdKRlFua0tXbGRhZWt3eWFHeFpWMUo2VERKT2RscEhWalJNTTFsNVRHcEZkR0p1UW5STVdFSjVZak5hYkdKdFJuVlpNbFYwWTIxV2FtSXpXbXhqYm10M1QwRlpTd3BMZDFsQ1FrRkhSSFo2UVVKRmQxRnhSRU5vYkUxcVNtdE5WRUYzVFZSWmVrNVVXVEZOVkZrd1dsUkplRTVFYkcxUFZHeG9XV3BWTUZwRVJYaFpWRmw0Q2sxVVJUVk5la3BwVFVORlIwTnBjMGRCVVZGQ1p6YzRkMEZTVVVWRmQzZFNaREk1ZVdFeVduTmlNMlJtV2tkc2VtTkhSakJaTW1kM1dFRlpTMHQzV1VJS1FrRkhSSFo2UVVKR1VWSlBSRVY0YjJSSVVuZGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbGRYUm5WYU1uQXhZbTF3Y0ZwVE1VMWhWelIyVlRKT2FBcGliWGcxVERKR2FtUkhiSFppYmsxMlkyNVdkV041T0hwT1JHTXhUa1JaTTAxNlZUQk9lVGxvWkVoU2JHSllRakJqZVRoNFRVSlpSME5wYzBkQlVWRkNDbWMzT0hkQlVsbEZRMEYzUjJOSVZtbGlSMnhxVFVaM1IwTnBjMGRCVVZGQ1p6YzRkMEZTWjBWVVozaE5ZMjFXZDJKNmNGcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnBPVlJaTWtaMVlraHJObU50Vm0xUGJrcHNXbTVOZG1GSFZtaGFTRTEyV1RJNWExcFlaM1prYWtsMVRWTXhkV05ITUhSalNFcDJaRzFXZFFwWlZ6VnFXbE14ZVZwWFRuWmtiVlo1WlZSRFFtbG5XVXRMZDFsQ1FrRklWMlZSU1VWQloxSTRRa2h2UVdWQlFqSkJUakE1VFVkeVIzaDRSWGxaZUd0bENraEtiRzVPZDB0cFUydzJORE5xZVhRdk5HVkxZMjlCZGt0bE5rOUJRVUZDYjBweFMycDFORUZCUVZGRVFVVmpkMUpSU1doQlNXazBjREZCYzNsNGExY0taQ3RYZG1GRGRXUTRRaXRLTUhGME5VWkRlRFptTkdoR2F6RlBXamd2WVZkQmFVSktXVlVyUlRGNFdVNTNhblowU1ZoV2RETkNSVTR3V1VONVpYcGFRd3BEYmxWSGRsb3lTM0JxYVdnd2VrRkxRbWRuY1docmFrOVFVVkZFUVhkT2IwRkVRbXhCYWtWQlp5OVVkRmwwUkhReGQyaFNOVXRHVTBwV1JFdHNkVGRDQ200M1puRlBhM0ZIVmt4ck9HOXFTelZETW1aUWNYcFJlbk5ZU0ZKb2NYQnRNblp5Y2pOb1ZFTkJha0phVUN0UU15dFhlbXQyTW5oSmFVOTJlRlZRTDJjS1NUWnBkMlphU2tOMGJISnZabGhFV1ZVNE1uazBSazUwVldaNlJuZHNLelowU1U5eWNsVlVSbkpyWXowS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9XX19" + } + ], + "timestampVerificationData": {} + }, + "dsseEnvelope": { + "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoicGtnOm5wbS8lNDBzY2FubHkvYnJvd3NlckAyLjEuMCIsImRpZ2VzdCI6eyJzaGE1MTIiOiIwN2ZmYTIwN2FhMmE4MjYwOWIwZTgwOGFlOTIyMWMzYzc3MzU5MDQwNmIzZmUxMWRkNDVlNGNmOTg0MGZjMTYyMTcwZTQyZWZkYThkODJlZjcyYjM5YjlmMzMzMDhlODRkYjgxOGEwMjM5ZTU2M2IzN2M2NmQwMDhjNzY4Y2YzZSJ9fV0sInByZWRpY2F0ZVR5cGUiOiJodHRwczovL3Nsc2EuZGV2L3Byb3ZlbmFuY2UvdjEiLCJwcmVkaWNhdGUiOnsiYnVpbGREZWZpbml0aW9uIjp7ImJ1aWxkVHlwZSI6Imh0dHBzOi8vc2xzYS1mcmFtZXdvcmsuZ2l0aHViLmlvL2dpdGh1Yi1hY3Rpb25zLWJ1aWxkdHlwZXMvd29ya2Zsb3cvdjEiLCJleHRlcm5hbFBhcmFtZXRlcnMiOnsid29ya2Zsb3ciOnsicmVmIjoicmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5IiwicmVwb3NpdG9yeSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkiLCJwYXRoIjoiLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbCJ9LCJzb3VyY2VfY29tbWl0IjoiNmIwMTdiNTNhNDQwNGY0ZmVhYjc3NmFjMTExYjBlYTlkYWNmMjczNCJ9LCJpbnRlcm5hbFBhcmFtZXRlcnMiOnsiZ2l0aHViIjp7ImV2ZW50X25hbWUiOiJ3b3JrZmxvd19kaXNwYXRjaCIsInJlcG9zaXRvcnlfaWQiOiIxMTU2MzQyNjUzIiwicmVwb3NpdG9yeV9vd25lcl9pZCI6IjIyNDM3MDg5OCJ9fSwicmVzb2x2ZWREZXBlbmRlbmNpZXMiOlt7InVyaSI6ImdpdCtodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5QHJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeSIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiJlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiIn19LHsidXJpIjoiZ2l0K2h0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHlANmIwMTdiNTNhNDQwNGY0ZmVhYjc3NmFjMTExYjBlYTlkYWNmMjczNCIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiI2YjAxN2I1M2E0NDA0ZjRmZWFiNzc2YWMxMTFiMGVhOWRhY2YyNzM0In19XX0sInJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY3Rpb25zL3J1bm5lci9naXRodWItaG9zdGVkIn0sIm1ldGFkYXRhIjp7Imludm9jYXRpb25JZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvYWN0aW9ucy9ydW5zLzM0NzU0NjczNTQ3L2F0dGVtcHRzLzEifX19fQ==", + "payloadType": "application/vnd.in-toto+json", + "signatures": [ + { + "sig": "MEQCIFkHgYhJK8JlzAxctUDgHDIQVSlQ3DRoUOS3k9jVuPdlAiB3g6qAayXUUatvwVcIVZhmusV6vTqpGj6ukagSFUypmA==" + } + ] + } +} diff --git a/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-core-2.1.0.tgz.sigstore.json b/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-core-2.1.0.tgz.sigstore.json new file mode 100644 index 0000000..7bb4bd2 --- /dev/null +++ b/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-core-2.1.0.tgz.sigstore.json @@ -0,0 +1,62 @@ +{ + "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", + "verificationMaterial": { + "certificate": { + "rawBytes": "MIIILTCCB7KgAwIBAgIUBEOTB1NFidwA7OvU8OduWCjGPBAwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTEzMTEzMjQ4WhcNMjYwOTEzMTE0MjQ4WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE4Ts2NEA+VFx4l22XL5WG9KrqK7OFucH+iLP7L0s3dwwvhcVUI6Ff7eRdbND78uU7CXy8luG3E4ZHKzJvuR4XVqOCBtEwggbNMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUAC6q8hYDwDxcjnbhIH+z3eEU2qcwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wgZkGA1UdEQEB/wSBjjCBi4aBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAfBgorBgEEAYO/MAECBBF3b3JrZmxvd19kaXNwYXRjaDA2BgorBgEEAYO/MAEDBChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCkGCisGAQQBg78wAQQEG3YyLjEgQXJ0aWZhY3QgUXVhbGlmaWNhdGlvbjAjBgorBgEEAYO/MAEFBBVZYW5nanVuamllLUxpbi9TY2FubHkwOwYKKwYBBAGDvzABBgQtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTCBmgYKKwYBBAGDvzABCQSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABCgQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMB0GCisGAQQBg78wAQsEDwwNZ2l0aHViLWhvc3RlZDA4BgorBgEEAYO/MAEMBCoMKGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkwOAYKKwYBBAGDvzABDQQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMD0GCisGAQQBg78wAQ4ELwwtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MBoGCisGAQQBg78wAQ8EDAwKMTE1NjM0MjY1MzAxBgorBgEEAYO/MAEQBCMMIWh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbjAZBgorBgEEAYO/MAERBAsMCTIyNDM3MDg5ODCBmgYKKwYBBAGDvzABEgSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABEwQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCEGCisGAQQBg78wARQEEwwRd29ya2Zsb3dfZGlzcGF0Y2gwXAYKKwYBBAGDvzABFQRODExodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5L2FjdGlvbnMvcnVucy8zNDc1NDY3MzU0Ny9hdHRlbXB0cy8xMBYGCisGAQQBg78wARYECAwGcHVibGljMFwGCisGAQQBg78wARgETgxMcmVwbzpZYW5nanVuamllLUxpbi9TY2FubHk6cmVmOnJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeTCBigYKKwYBBAHWeQIEAgR8BHoAeAB2AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABoJqKk4QAAAQDAEcwRQIgfuj6w3gOirgYg982IxdS/ndlQggXnZbSbwmSP0M8WVkCIQCJzLTYXi7sbg1V+rIqQ3o2bzDvoCyEM223QNd1FcgeMjAKBggqhkjOPQQDAwNpADBmAjEA54KAyeumTK475C15W/IT1Kqn5/Zr0J8rD1dDY4lPNVA7VudX/Md8db3d6vxr1KrSAjEAou67vL9xKPUG+kTkZx75mW0uJGHQRNhjX0H0Ih+gsrW0G6iNP9foIr2pmW2CbYYi" + }, + "tlogEntries": [ + { + "logIndex": "2817433476", + "logId": { + "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=" + }, + "kindVersion": { + "kind": "dsse", + "version": "0.0.1" + }, + "integratedTime": "1789299168", + "inclusionPromise": { + "signedEntryTimestamp": "MEUCIQDXaz+rVybGsXjFUhXlYL3YMD1UAp+N4LwrpHOaLLFvOwIgbFHZr1BU9aUwdg9NUbq0Ig5y8de07iQmLX7S5Sgkzj8=" + }, + "inclusionProof": { + "logIndex": "2695529214", + "rootHash": "qKemsoVVbWX3dVQdOLmZk/fybAXlqeinWeM8ySKWVjQ=", + "treeSize": "2695529243", + "hashes": [ + "hFZ/lqvwHlrbHlSNpAbeDkDf6Ngwg+7noYX1K/oEoRU=", + "n6i9Cucfw7Q2Zew+L9H8ikUxBuZlXeRGYhrS8izWTVc=", + "5/NXS8pi5OUnL2S+qhUvzDiTc6mIGv4sJra2KCq5qMk=", + "aQN1wmvzyfcz8ru8A2GOmc3Yb1DXwviEUCh8PKeigdo=", + "YAXpKLl2X7bzsRPiCK9fcumwbuUZZ2trS1suViHL8EQ=", + "oE5bS4OW3+K0H61mWLZT4lFFVAdojtNKoXDNyEmKbWE=", + "bw8MeZUTSR6pHl7DupQ99J//dgZrL4nGt4Hqh//SmZI=", + "HQxko3DT+JxlVyUQbPOQ5itczfAs8i+JTgK4ZcUooAA=", + "ny+O/0nG48jIhjbE2qHRs25c17nvSRBvFcNdNSglY9I=", + "JB/RNmp6kfQ4AFK/yjP1W28cn5xu4p4PvAGOfnm1q5c=", + "99PoJTYgPWevn9oVlADbWdRGR90JL8Fx/FV0T06o0IA=", + "LQtwekqXPoO3KgXYEfRsV0WYK6Gk0PLLePxJWdZgThQ=", + "qOZd1StyLttRdZ9ojwet4/yO1QqFuSN2bQKQaTXLrkY=", + "uXYCZMF7lS28YUWZqw7VfMV5vdtFS6j7/bavDJtBebk=", + "S39m2eTD1rqRuAMs4r+sGsYIwW0BlTWuysWTKJ8RKVk=", + "qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=", + "xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY=" + ], + "checkpoint": { + "envelope": "rekor.sigstore.dev - 1193050959916656506\n2695529243\nqKemsoVVbWX3dVQdOLmZk/fybAXlqeinWeM8ySKWVjQ=\n\n— rekor.sigstore.dev wNI9ajBGAiEAscQS8gASDyewji8ii+1lBvIhnESOCkaARQwRg98lu0gCIQCSJQIZOjWvr7+tqED4Wb3U7s75/wNkVxl+1IABIn05Vg==\n" + } + }, + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiZDRiYjA3ZjFhOGVhMTMwM2JlNGFjZGRmMzkyZmMyYjNiNDE0MzFjNmE5Y2ZlMWMxNDZhYTI1MjcyZDczYmYxMSJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImNiYjQyMzcxYjAzYjIxYzM3NWVjZmI2OWUwNTZkYzFkZmNlOGIzMTYxZWJiYWMzMWZhOGUzMTdkYzhiMmNiMTEifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVVQ0lCZVpqMndXTFJSdlM2NUdHWWlsMWNCb25lSTRid2NBTFlQNEtwaG00OHYxQWlFQTU2YWdHMDIyMUtlazcyRDhFeEkyVHpNdnVPZ2lkaEprRjV4SGZBR1RuS2M9IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VsTVZFTkRRamRMWjBGM1NVSkJaMGxWUWtWUFZFSXhUa1pwWkhkQk4wOTJWVGhQWkhWWFEycEhVRUpCZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwOVVSWHBOVkVWNlRXcFJORmRvWTA1TmFsbDNUMVJGZWsxVVJUQk5hbEUwVjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVTBWSE15VGtWQksxWkdlRFJzTWpKWVREVlhSemxMY25GTE4wOUdkV05JSzJsTVVEY0tUREJ6TTJSM2QzWm9ZMVpWU1RaR1pqZGxVbVJpVGtRM09IVlZOME5ZZVRoc2RVY3pSVFJhU0V0NlNuWjFValJZVm5GUFEwSjBSWGRuWjJKT1RVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVkJRelp4Q2pob1dVUjNSSGhqYW01aWFFbElLM296WlVWVk1uRmpkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMmRhYTBkQk1WVmtSVkZGUWk5M1UwSnFha05DYVRSaFFtbEhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RRcGhiV3hzVEZWNGNHSnBPVlJaTWtaMVlraHJka3h0WkhCa1IyZ3hXV2s1TTJJelNuSmFiWGgyWkROTmRtUnFTWFZOVXpGb1kyNVNjRnB0Um1wa1F6RjRDbVJYUm5OaFYxcHdXVEpHTUdGWE9YVk1ibXgwWWtWQ2VWcFhXbnBNTW1oc1dWZFNla3d5VG5aYVIxWTBURE5aZVV4cVJYUmlia0owVEZoQ2VXSXpXbXdLWW0xR2RWa3lWWFJqYlZacVlqTmFiR051YTNkUFVWbExTM2RaUWtKQlIwUjJla0ZDUVZGUmNtRklVakJqU0UwMlRIazVNR0l5ZEd4aWFUVm9XVE5TY0FwaU1qVjZURzFrY0dSSGFERlpibFo2V2xoS2FtSXlOVEJhVnpVd1RHMU9kbUpVUVdaQ1oyOXlRbWRGUlVGWlR5OU5RVVZEUWtKR00ySXpTbkphYlhoMkNtUXhPV3RoV0U1M1dWaFNhbUZFUVRKQ1oyOXlRbWRGUlVGWlR5OU5RVVZFUWtOb2JFMXFTbXROVkVGM1RWUlplazVVV1RGTlZGa3dXbFJKZUU1RWJHMEtUMVJzYUZscVZUQmFSRVY0V1ZSWmVFMVVSVFZOZWtwcFRVTnJSME5wYzBkQlVWRkNaemM0ZDBGUlVVVkhNMWw1VEdwRloxRllTakJoVjFwb1dUTlJad3BWV0Zab1lrZHNiV0ZYVG1oa1IyeDJZbXBCYWtKbmIzSkNaMFZGUVZsUEwwMUJSVVpDUWxaYVdWYzFibUZ1Vm5WaGJXeHNURlY0Y0dKcE9WUlpNa1oxQ21KSWEzZFBkMWxMUzNkWlFrSkJSMFIyZWtGQ1FtZFJkR050Vm0xamVUbHZXbGRHYTJONU9XcGlNbEpzWlVNNU1rMXBOSGhNVnpWM1lsTXhkMk50T1RJS1dsYzFhR0p0VG14TVdFcHNXVEk1TWxwWVNqVk5SSE5IUTJselIwRlJVVUpuTnpoM1FWRm5SVXhSZDNKaFNGSXdZMGhOTmt4NU9UQmlNblJzWW1rMWFBcFpNMUp3WWpJMWVreHRaSEJrUjJneFdXNVdlbHBZU21waU1qVXdXbGMxTUV4dFRuWmlWRU5DYldkWlMwdDNXVUpDUVVkRWRucEJRa05SVTBKcGQzbENDbWxIYURCa1NFSjZUMms0ZGxveWJEQmhTRlpwVEcxT2RtSlRPVnBaVnpWdVlXNVdkV0Z0Ykd4TVZYaHdZbWs1VkZreVJuVmlTR3QyVEcxa2NHUkhhREVLV1drNU0ySXpTbkphYlhoMlpETk5kbVJxU1hWTlV6Rm9ZMjVTY0ZwdFJtcGtRekY0WkZkR2MyRlhXbkJaTWtZd1lWYzVkVXh1YkhSaVJVSjVXbGRhZWdwTU1taHNXVmRTZWt3eVRuWmFSMVkwVEROWmVVeHFSWFJpYmtKMFRGaENlV0l6V214aWJVWjFXVEpWZEdOdFZtcGlNMXBzWTI1cmQwOUJXVXRMZDFsQ0NrSkJSMFIyZWtGQ1EyZFJjVVJEYUd4TmFrcHJUVlJCZDAxVVdYcE9WRmt4VFZSWk1GcFVTWGhPUkd4dFQxUnNhRmxxVlRCYVJFVjRXVlJaZUUxVVJUVUtUWHBLYVUxQ01FZERhWE5IUVZGUlFtYzNPSGRCVVhORlJIZDNUbG95YkRCaFNGWnBURmRvZG1NelVteGFSRUUwUW1kdmNrSm5SVVZCV1U4dlRVRkZUUXBDUTI5TlMwZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNVdsbFhOVzVoYmxaMVlXMXNiRXhWZUhCaWFUbFVXVEpHZFdKSWEzZFBRVmxMQ2t0M1dVSkNRVWRFZG5wQlFrUlJVWEZFUTJoc1RXcEthMDFVUVhkTlZGbDZUbFJaTVUxVVdUQmFWRWw0VGtSc2JVOVViR2haYWxVd1drUkZlRmxVV1hnS1RWUkZOVTE2U21sTlJEQkhRMmx6UjBGUlVVSm5OemgzUVZFMFJVeDNkM1JqYlZadFkzazViMXBYUm10amVUbHFZakpTYkdWRE9USk5hVFI0VEZjMWR3cGlVekYzWTIwNU1scFhOV2hpYlU1c1RGaEtiRmt5T1RKYVdFbzFUVUp2UjBOcGMwZEJVVkZDWnpjNGQwRlJPRVZFUVhkTFRWUkZNVTVxVFRCTmFsa3hDazE2UVhoQ1oyOXlRbWRGUlVGWlR5OU5RVVZSUWtOTlRVbFhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnFRVnBDWjI5eVFtZEZSVUZaVHk5TlFVVlNRa0Z6VFVOVVNYbE9SRTB6VFVSbk5VOUVRMEp0WjFsTFMzZFpRa0pCUjBSMmVrRkNSV2RUUWdwcGQzbENhVWRvTUdSSVFucFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVXbGxYTlc1aGJsWjFZVzFzYkV4VmVIQmlhVGxVV1RKR2RXSklhM1pNYldSd0NtUkhhREZaYVRrellqTktjbHB0ZUhaa00wMTJaR3BKZFUxVE1XaGpibEp3V20xR2FtUkRNWGhrVjBaellWZGFjRmt5UmpCaFZ6bDFURzVzZEdKRlFua0tXbGRhZWt3eWFHeFpWMUo2VERKT2RscEhWalJNTTFsNVRHcEZkR0p1UW5STVdFSjVZak5hYkdKdFJuVlpNbFYwWTIxV2FtSXpXbXhqYm10M1QwRlpTd3BMZDFsQ1FrRkhSSFo2UVVKRmQxRnhSRU5vYkUxcVNtdE5WRUYzVFZSWmVrNVVXVEZOVkZrd1dsUkplRTVFYkcxUFZHeG9XV3BWTUZwRVJYaFpWRmw0Q2sxVVJUVk5la3BwVFVORlIwTnBjMGRCVVZGQ1p6YzRkMEZTVVVWRmQzZFNaREk1ZVdFeVduTmlNMlJtV2tkc2VtTkhSakJaTW1kM1dFRlpTMHQzV1VJS1FrRkhSSFo2UVVKR1VWSlBSRVY0YjJSSVVuZGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbGRYUm5WYU1uQXhZbTF3Y0ZwVE1VMWhWelIyVlRKT2FBcGliWGcxVERKR2FtUkhiSFppYmsxMlkyNVdkV041T0hwT1JHTXhUa1JaTTAxNlZUQk9lVGxvWkVoU2JHSllRakJqZVRoNFRVSlpSME5wYzBkQlVWRkNDbWMzT0hkQlVsbEZRMEYzUjJOSVZtbGlSMnhxVFVaM1IwTnBjMGRCVVZGQ1p6YzRkMEZTWjBWVVozaE5ZMjFXZDJKNmNGcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnBPVlJaTWtaMVlraHJObU50Vm0xUGJrcHNXbTVOZG1GSFZtaGFTRTEyV1RJNWExcFlaM1prYWtsMVRWTXhkV05ITUhSalNFcDJaRzFXZFFwWlZ6VnFXbE14ZVZwWFRuWmtiVlo1WlZSRFFtbG5XVXRMZDFsQ1FrRklWMlZSU1VWQloxSTRRa2h2UVdWQlFqSkJUakE1VFVkeVIzaDRSWGxaZUd0bENraEtiRzVPZDB0cFUydzJORE5xZVhRdk5HVkxZMjlCZGt0bE5rOUJRVUZDYjBweFMyczBVVUZCUVZGRVFVVmpkMUpSU1dkbWRXbzJkek5uVDJseVoxa0taems0TWtsNFpGTXZibVJzVVdkbldHNWFZbE5pZDIxVFVEQk5PRmRXYTBOSlVVTktla3hVV1ZocE4zTmlaekZXSzNKSmNWRXpiekppZWtSMmIwTjVSUXBOTWpJelVVNWtNVVpqWjJWTmFrRkxRbWRuY1docmFrOVFVVkZFUVhkT2NFRkVRbTFCYWtWQk5UUkxRWGxsZFcxVVN6UTNOVU14TlZjdlNWUXhTM0Z1Q2pVdlduSXdTamh5UkRGa1JGazBiRkJPVmtFM1ZuVmtXQzlOWkRoa1lqTmtOblo0Y2pGTGNsTkJha1ZCYjNVMk4zWk1PWGhMVUZWSEsydFVhMXA0TnpVS2JWY3dkVXBIU0ZGU1RtaHFXREJJTUVsb0syZHpjbGN3UnpacFRsQTVabTlKY2pKd2JWY3lRMkpaV1drS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9XX19" + } + ], + "timestampVerificationData": {} + }, + "dsseEnvelope": { + "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoicGtnOm5wbS8lNDBzY2FubHkvY29yZUAyLjEuMCIsImRpZ2VzdCI6eyJzaGE1MTIiOiJjNmE4MTIzMTI4N2Y4YzliN2E3ZTMwNDgxZjY1ZDQ5NzQ5Njc3MWIwMDNkN2QzMTE0YTBiYzdjZGVjMDNiYWFjODAxYmFhNmMwOTU5NzhiOTFkNzdmNDhlYzQ4OWEwMzIwNTUwODI4OWNkZmNkZWU5YjcyYTVlOGVhZDEwZTJiZCJ9fV0sInByZWRpY2F0ZVR5cGUiOiJodHRwczovL3Nsc2EuZGV2L3Byb3ZlbmFuY2UvdjEiLCJwcmVkaWNhdGUiOnsiYnVpbGREZWZpbml0aW9uIjp7ImJ1aWxkVHlwZSI6Imh0dHBzOi8vc2xzYS1mcmFtZXdvcmsuZ2l0aHViLmlvL2dpdGh1Yi1hY3Rpb25zLWJ1aWxkdHlwZXMvd29ya2Zsb3cvdjEiLCJleHRlcm5hbFBhcmFtZXRlcnMiOnsid29ya2Zsb3ciOnsicmVmIjoicmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5IiwicmVwb3NpdG9yeSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkiLCJwYXRoIjoiLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbCJ9LCJzb3VyY2VfY29tbWl0IjoiNmIwMTdiNTNhNDQwNGY0ZmVhYjc3NmFjMTExYjBlYTlkYWNmMjczNCJ9LCJpbnRlcm5hbFBhcmFtZXRlcnMiOnsiZ2l0aHViIjp7ImV2ZW50X25hbWUiOiJ3b3JrZmxvd19kaXNwYXRjaCIsInJlcG9zaXRvcnlfaWQiOiIxMTU2MzQyNjUzIiwicmVwb3NpdG9yeV9vd25lcl9pZCI6IjIyNDM3MDg5OCJ9fSwicmVzb2x2ZWREZXBlbmRlbmNpZXMiOlt7InVyaSI6ImdpdCtodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5QHJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeSIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiJlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiIn19LHsidXJpIjoiZ2l0K2h0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHlANmIwMTdiNTNhNDQwNGY0ZmVhYjc3NmFjMTExYjBlYTlkYWNmMjczNCIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiI2YjAxN2I1M2E0NDA0ZjRmZWFiNzc2YWMxMTFiMGVhOWRhY2YyNzM0In19XX0sInJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY3Rpb25zL3J1bm5lci9naXRodWItaG9zdGVkIn0sIm1ldGFkYXRhIjp7Imludm9jYXRpb25JZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvYWN0aW9ucy9ydW5zLzM0NzU0NjczNTQ3L2F0dGVtcHRzLzEifX19fQ==", + "payloadType": "application/vnd.in-toto+json", + "signatures": [ + { + "sig": "MEUCIBeZj2wWLRRvS65GGYil1cBoneI4bwcALYP4Kphm48v1AiEA56agG0221Kek72D8ExI2TzMvuOgidhJkF5xHfAGTnKc=" + } + ] + } +} diff --git a/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-engine-jsqr-2.1.0.tgz.sigstore.json b/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-engine-jsqr-2.1.0.tgz.sigstore.json new file mode 100644 index 0000000..d557ab6 --- /dev/null +++ b/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-engine-jsqr-2.1.0.tgz.sigstore.json @@ -0,0 +1,62 @@ +{ + "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", + "verificationMaterial": { + "certificate": { + "rawBytes": "MIIILDCCB7KgAwIBAgIULEPsldWWED4nSk+dvBmHP5VET6EwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTEzMTEzMjUzWhcNMjYwOTEzMTE0MjUzWjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAENdXRWYfnu0vQSGIlh9nD4CSnzdsGKvJnbaH+yc0WhDV7iXvcmTgn9uSYqHmH30TQtOzTfkZ9hftGZUCWwSABz6OCBtEwggbNMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQU6fS5TqinZi/jrrhb6HMAVAnTeIAwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wgZkGA1UdEQEB/wSBjjCBi4aBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAfBgorBgEEAYO/MAECBBF3b3JrZmxvd19kaXNwYXRjaDA2BgorBgEEAYO/MAEDBChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCkGCisGAQQBg78wAQQEG3YyLjEgQXJ0aWZhY3QgUXVhbGlmaWNhdGlvbjAjBgorBgEEAYO/MAEFBBVZYW5nanVuamllLUxpbi9TY2FubHkwOwYKKwYBBAGDvzABBgQtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTCBmgYKKwYBBAGDvzABCQSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABCgQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMB0GCisGAQQBg78wAQsEDwwNZ2l0aHViLWhvc3RlZDA4BgorBgEEAYO/MAEMBCoMKGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkwOAYKKwYBBAGDvzABDQQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMD0GCisGAQQBg78wAQ4ELwwtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MBoGCisGAQQBg78wAQ8EDAwKMTE1NjM0MjY1MzAxBgorBgEEAYO/MAEQBCMMIWh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbjAZBgorBgEEAYO/MAERBAsMCTIyNDM3MDg5ODCBmgYKKwYBBAGDvzABEgSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABEwQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCEGCisGAQQBg78wARQEEwwRd29ya2Zsb3dfZGlzcGF0Y2gwXAYKKwYBBAGDvzABFQRODExodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5L2FjdGlvbnMvcnVucy8zNDc1NDY3MzU0Ny9hdHRlbXB0cy8xMBYGCisGAQQBg78wARYECAwGcHVibGljMFwGCisGAQQBg78wARgETgxMcmVwbzpZYW5nanVuamllLUxpbi9TY2FubHk6cmVmOnJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeTCBigYKKwYBBAHWeQIEAgR8BHoAeAB2AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABoJqKqUcAAAQDAEcwRQIgXLOrDvHGE7SsxO/3ABIPEUAcjwf0hTyIyI7Z6NmwE18CIQCppHBn5LLwfyrjWc81ghRnp/1gJ2QQEyWfV9JAQzch2jAKBggqhkjOPQQDAwNoADBlAjB2EU5uKD6/to6SaSjwa1Y9HBwlo5fSQ1PD2cH9OxLYO5l1/GBBH4t8oQ8urWedrFACMQD6qT15CpwJUZChzSKm4Hp6HnGrDngymok0ymanAlyze+mozC5dLcC7Gd6touwg6i8=" + }, + "tlogEntries": [ + { + "logIndex": "2817434169", + "logId": { + "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=" + }, + "kindVersion": { + "kind": "dsse", + "version": "0.0.1" + }, + "integratedTime": "1789299173", + "inclusionPromise": { + "signedEntryTimestamp": "MEQCIBM9RpQwxtJ8KS2nITAS/NctLkVvJbXHXsiJ+IOEgl7DAiBVMD0Xa7TmahhNV6MUPv1ZCnIWcSdDfhoXLSJmhpq05A==" + }, + "inclusionProof": { + "logIndex": "2695529907", + "rootHash": "o13hvp+52hGB/lTY7nRj41M2+GAnRX23QuVuVEni2a4=", + "treeSize": "2695529921", + "hashes": [ + "R9hx2FC3mLd7TPuI4n/jA3UPmgU7I5QotQOQObbQJvM=", + "hRAE7GSimcr7HYTnvwpr2d38M9MfcxhJ+Cg34sZQUdU=", + "kQ4SMcBbLa9SpqQndYKf2KfxlH0mhNcteL+bAkELlXo=", + "ztYxX98cAE5Wg+NP8nYQiYuFT/Gy4NFVEEhcoqohGys=", + "WM72b+BfOmSS+Nqd2BjkBbGZlAWuRPCGQfteC5EAj7g=", + "q9pPFCD4TLqq0cUYWxPuadfU7zGpghNanVnPkCV5NLs=", + "4r2MVMrVln547445uGK73oVirEJQaTA/MGr+qgfJx/k=", + "IunhHGulMjtIRB03ORwS0mZc9Dh/V7y6Zfd/RTbD4Zw=", + "kdla8MzFBhwDILy05yGsk7TUXVwm7RUcoVF7mG30esM=", + "ys1AmRgOQ1cBbTrHqVAy0aCMdqJ6C/QxHXAD9GZhxmA=", + "99PoJTYgPWevn9oVlADbWdRGR90JL8Fx/FV0T06o0IA=", + "LQtwekqXPoO3KgXYEfRsV0WYK6Gk0PLLePxJWdZgThQ=", + "qOZd1StyLttRdZ9ojwet4/yO1QqFuSN2bQKQaTXLrkY=", + "uXYCZMF7lS28YUWZqw7VfMV5vdtFS6j7/bavDJtBebk=", + "S39m2eTD1rqRuAMs4r+sGsYIwW0BlTWuysWTKJ8RKVk=", + "qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=", + "xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY=" + ], + "checkpoint": { + "envelope": "rekor.sigstore.dev - 1193050959916656506\n2695529921\no13hvp+52hGB/lTY7nRj41M2+GAnRX23QuVuVEni2a4=\n\n— rekor.sigstore.dev wNI9ajBFAiEArZDe21IsuO/OUIcmUPPW0FyLDx+z5fcpQV11VUKSVSUCIFayR/9d2tzW4v+k+EFGhocNBGiEcOfWjV1Jj1Qaqrde\n" + } + }, + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiMmU0MTMzMjI5MzRlYjkwNjE3MTNjMmQ0YWY2NzUzYTUyZGM4ZDk0MjY2YmI2MGQxMGUxYTdmNWRhMjkyMzZiMyJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjMxNmQ3MDNiZWJjMjlkOGQ3MzYyNTE2NjcyYTVhMjUyMDllMDM5YTRmYjczZmU5YTljNjkzOTAxNTZiNTM1ODkifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVVQ0lHbVZxZXUrMDhuWTg2cmZnTXFRSW9VOXBHYno4Qms0Q3VpL0Yram8yaWNjQWlFQTBzQVRzVEkxQ0hHR2xSSEFPc0plaG02eU5Nb0RHakRTdzl4a2l3aldkRkk9IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VsTVJFTkRRamRMWjBGM1NVSkJaMGxWVEVWUWMyeGtWMWRGUkRSdVUyc3JaSFpDYlVoUU5WWkZWRFpGZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwOVVSWHBOVkVWNlRXcFZlbGRvWTA1TmFsbDNUMVJGZWsxVVJUQk5hbFY2VjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVk9aRmhTVjFsbWJuVXdkbEZUUjBsc2FEbHVSRFJEVTI1NlpITkhTM1pLYm1KaFNDc0tlV013VjJoRVZqZHBXSFpqYlZSbmJqbDFVMWx4U0cxSU16QlVVWFJQZWxSbWExbzVhR1owUjFwVlExZDNVMEZDZWpaUFEwSjBSWGRuWjJKT1RVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVTJabE0xQ2xSeGFXNWFhUzlxY25Kb1lqWklUVUZXUVc1VVpVbEJkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMmRhYTBkQk1WVmtSVkZGUWk5M1UwSnFha05DYVRSaFFtbEhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RRcGhiV3hzVEZWNGNHSnBPVlJaTWtaMVlraHJka3h0WkhCa1IyZ3hXV2s1TTJJelNuSmFiWGgyWkROTmRtUnFTWFZOVXpGb1kyNVNjRnB0Um1wa1F6RjRDbVJYUm5OaFYxcHdXVEpHTUdGWE9YVk1ibXgwWWtWQ2VWcFhXbnBNTW1oc1dWZFNla3d5VG5aYVIxWTBURE5aZVV4cVJYUmlia0owVEZoQ2VXSXpXbXdLWW0xR2RWa3lWWFJqYlZacVlqTmFiR051YTNkUFVWbExTM2RaUWtKQlIwUjJla0ZDUVZGUmNtRklVakJqU0UwMlRIazVNR0l5ZEd4aWFUVm9XVE5TY0FwaU1qVjZURzFrY0dSSGFERlpibFo2V2xoS2FtSXlOVEJhVnpVd1RHMU9kbUpVUVdaQ1oyOXlRbWRGUlVGWlR5OU5RVVZEUWtKR00ySXpTbkphYlhoMkNtUXhPV3RoV0U1M1dWaFNhbUZFUVRKQ1oyOXlRbWRGUlVGWlR5OU5RVVZFUWtOb2JFMXFTbXROVkVGM1RWUlplazVVV1RGTlZGa3dXbFJKZUU1RWJHMEtUMVJzYUZscVZUQmFSRVY0V1ZSWmVFMVVSVFZOZWtwcFRVTnJSME5wYzBkQlVWRkNaemM0ZDBGUlVVVkhNMWw1VEdwRloxRllTakJoVjFwb1dUTlJad3BWV0Zab1lrZHNiV0ZYVG1oa1IyeDJZbXBCYWtKbmIzSkNaMFZGUVZsUEwwMUJSVVpDUWxaYVdWYzFibUZ1Vm5WaGJXeHNURlY0Y0dKcE9WUlpNa1oxQ21KSWEzZFBkMWxMUzNkWlFrSkJSMFIyZWtGQ1FtZFJkR050Vm0xamVUbHZXbGRHYTJONU9XcGlNbEpzWlVNNU1rMXBOSGhNVnpWM1lsTXhkMk50T1RJS1dsYzFhR0p0VG14TVdFcHNXVEk1TWxwWVNqVk5SSE5IUTJselIwRlJVVUpuTnpoM1FWRm5SVXhSZDNKaFNGSXdZMGhOTmt4NU9UQmlNblJzWW1rMWFBcFpNMUp3WWpJMWVreHRaSEJrUjJneFdXNVdlbHBZU21waU1qVXdXbGMxTUV4dFRuWmlWRU5DYldkWlMwdDNXVUpDUVVkRWRucEJRa05SVTBKcGQzbENDbWxIYURCa1NFSjZUMms0ZGxveWJEQmhTRlpwVEcxT2RtSlRPVnBaVnpWdVlXNVdkV0Z0Ykd4TVZYaHdZbWs1VkZreVJuVmlTR3QyVEcxa2NHUkhhREVLV1drNU0ySXpTbkphYlhoMlpETk5kbVJxU1hWTlV6Rm9ZMjVTY0ZwdFJtcGtRekY0WkZkR2MyRlhXbkJaTWtZd1lWYzVkVXh1YkhSaVJVSjVXbGRhZWdwTU1taHNXVmRTZWt3eVRuWmFSMVkwVEROWmVVeHFSWFJpYmtKMFRGaENlV0l6V214aWJVWjFXVEpWZEdOdFZtcGlNMXBzWTI1cmQwOUJXVXRMZDFsQ0NrSkJSMFIyZWtGQ1EyZFJjVVJEYUd4TmFrcHJUVlJCZDAxVVdYcE9WRmt4VFZSWk1GcFVTWGhPUkd4dFQxUnNhRmxxVlRCYVJFVjRXVlJaZUUxVVJUVUtUWHBLYVUxQ01FZERhWE5IUVZGUlFtYzNPSGRCVVhORlJIZDNUbG95YkRCaFNGWnBURmRvZG1NelVteGFSRUUwUW1kdmNrSm5SVVZCV1U4dlRVRkZUUXBDUTI5TlMwZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNVdsbFhOVzVoYmxaMVlXMXNiRXhWZUhCaWFUbFVXVEpHZFdKSWEzZFBRVmxMQ2t0M1dVSkNRVWRFZG5wQlFrUlJVWEZFUTJoc1RXcEthMDFVUVhkTlZGbDZUbFJaTVUxVVdUQmFWRWw0VGtSc2JVOVViR2haYWxVd1drUkZlRmxVV1hnS1RWUkZOVTE2U21sTlJEQkhRMmx6UjBGUlVVSm5OemgzUVZFMFJVeDNkM1JqYlZadFkzazViMXBYUm10amVUbHFZakpTYkdWRE9USk5hVFI0VEZjMWR3cGlVekYzWTIwNU1scFhOV2hpYlU1c1RGaEtiRmt5T1RKYVdFbzFUVUp2UjBOcGMwZEJVVkZDWnpjNGQwRlJPRVZFUVhkTFRWUkZNVTVxVFRCTmFsa3hDazE2UVhoQ1oyOXlRbWRGUlVGWlR5OU5RVVZSUWtOTlRVbFhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnFRVnBDWjI5eVFtZEZSVUZaVHk5TlFVVlNRa0Z6VFVOVVNYbE9SRTB6VFVSbk5VOUVRMEp0WjFsTFMzZFpRa0pCUjBSMmVrRkNSV2RUUWdwcGQzbENhVWRvTUdSSVFucFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVXbGxYTlc1aGJsWjFZVzFzYkV4VmVIQmlhVGxVV1RKR2RXSklhM1pNYldSd0NtUkhhREZaYVRrellqTktjbHB0ZUhaa00wMTJaR3BKZFUxVE1XaGpibEp3V20xR2FtUkRNWGhrVjBaellWZGFjRmt5UmpCaFZ6bDFURzVzZEdKRlFua0tXbGRhZWt3eWFHeFpWMUo2VERKT2RscEhWalJNTTFsNVRHcEZkR0p1UW5STVdFSjVZak5hYkdKdFJuVlpNbFYwWTIxV2FtSXpXbXhqYm10M1QwRlpTd3BMZDFsQ1FrRkhSSFo2UVVKRmQxRnhSRU5vYkUxcVNtdE5WRUYzVFZSWmVrNVVXVEZOVkZrd1dsUkplRTVFYkcxUFZHeG9XV3BWTUZwRVJYaFpWRmw0Q2sxVVJUVk5la3BwVFVORlIwTnBjMGRCVVZGQ1p6YzRkMEZTVVVWRmQzZFNaREk1ZVdFeVduTmlNMlJtV2tkc2VtTkhSakJaTW1kM1dFRlpTMHQzV1VJS1FrRkhSSFo2UVVKR1VWSlBSRVY0YjJSSVVuZGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbGRYUm5WYU1uQXhZbTF3Y0ZwVE1VMWhWelIyVlRKT2FBcGliWGcxVERKR2FtUkhiSFppYmsxMlkyNVdkV041T0hwT1JHTXhUa1JaTTAxNlZUQk9lVGxvWkVoU2JHSllRakJqZVRoNFRVSlpSME5wYzBkQlVWRkNDbWMzT0hkQlVsbEZRMEYzUjJOSVZtbGlSMnhxVFVaM1IwTnBjMGRCVVZGQ1p6YzRkMEZTWjBWVVozaE5ZMjFXZDJKNmNGcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnBPVlJaTWtaMVlraHJObU50Vm0xUGJrcHNXbTVOZG1GSFZtaGFTRTEyV1RJNWExcFlaM1prYWtsMVRWTXhkV05ITUhSalNFcDJaRzFXZFFwWlZ6VnFXbE14ZVZwWFRuWmtiVlo1WlZSRFFtbG5XVXRMZDFsQ1FrRklWMlZSU1VWQloxSTRRa2h2UVdWQlFqSkJUakE1VFVkeVIzaDRSWGxaZUd0bENraEtiRzVPZDB0cFUydzJORE5xZVhRdk5HVkxZMjlCZGt0bE5rOUJRVUZDYjBweFMzRlZZMEZCUVZGRVFVVmpkMUpSU1dkWVRFOXlSSFpJUjBVM1UzTUtlRTh2TTBGQ1NWQkZWVUZqYW5kbU1HaFVlVWw1U1RkYU5rNXRkMFV4T0VOSlVVTndjRWhDYmpWTVRIZG1lWEpxVjJNNE1XZG9VbTV3THpGblNqSlJVUXBGZVZkbVZqbEtRVkY2WTJneWFrRkxRbWRuY1docmFrOVFVVkZFUVhkT2IwRkVRbXhCYWtJeVJWVTFkVXRFTmk5MGJ6WlRZVk5xZDJFeFdUbElRbmRzQ204MVpsTlJNVkJFTW1OSU9VOTRURmxQTld3eEwwZENRa2cwZERodlVUaDFjbGRsWkhKR1FVTk5VVVEyY1ZReE5VTndkMHBWV2tOb2VsTkxiVFJJY0RZS1NHNUhja1J1WjNsdGIyc3dlVzFoYmtGc2VYcGxLMjF2ZWtNMVpFeGpRemRIWkRaMGIzVjNaelpwT0QwS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9XX19" + } + ], + "timestampVerificationData": {} + }, + "dsseEnvelope": { + "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoicGtnOm5wbS8lNDBzY2FubHkvZW5naW5lLWpzcXJAMi4xLjAiLCJkaWdlc3QiOnsic2hhNTEyIjoiNDU1MGE3YjU2MTk2ZTNmNjg2ZGU0MWNmMjc4ZjlmMjhjOWE5ZDU3Y2NiNmU2Mjc3YTBmZjcwN2VjZDg0MjJjMjRkMGJhNTNmNjM4NTFkMTgxYjRiMDhiNjIwMjZmYzVkMmIzMTkxYzUyMmJjOWMzOGQ3NzQ1YTBkNTg4NTRkMzUifX1dLCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9zbHNhLmRldi9wcm92ZW5hbmNlL3YxIiwicHJlZGljYXRlIjp7ImJ1aWxkRGVmaW5pdGlvbiI6eyJidWlsZFR5cGUiOiJodHRwczovL3Nsc2EtZnJhbWV3b3JrLmdpdGh1Yi5pby9naXRodWItYWN0aW9ucy1idWlsZHR5cGVzL3dvcmtmbG93L3YxIiwiZXh0ZXJuYWxQYXJhbWV0ZXJzIjp7IndvcmtmbG93Ijp7InJlZiI6InJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeSIsInJlcG9zaXRvcnkiOiJodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5IiwicGF0aCI6Ii5naXRodWIvd29ya2Zsb3dzL3YyLjEtYXJ0aWZhY3QtcXVhbGlmaWNhdGlvbi55bWwifSwic291cmNlX2NvbW1pdCI6IjZiMDE3YjUzYTQ0MDRmNGZlYWI3NzZhYzExMWIwZWE5ZGFjZjI3MzQifSwiaW50ZXJuYWxQYXJhbWV0ZXJzIjp7ImdpdGh1YiI6eyJldmVudF9uYW1lIjoid29ya2Zsb3dfZGlzcGF0Y2giLCJyZXBvc2l0b3J5X2lkIjoiMTE1NjM0MjY1MyIsInJlcG9zaXRvcnlfb3duZXJfaWQiOiIyMjQzNzA4OTgifX0sInJlc29sdmVkRGVwZW5kZW5jaWVzIjpbeyJ1cmkiOiJnaXQraHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seUByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkiLCJkaWdlc3QiOnsiZ2l0Q29tbWl0IjoiZTIyZDEwMDE2MzU2NTE2NGUyMTQ5Zjk5YWI1NGQxMWE2MTExOTMyYiJ9fSx7InVyaSI6ImdpdCtodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5QDZiMDE3YjUzYTQ0MDRmNGZlYWI3NzZhYzExMWIwZWE5ZGFjZjI3MzQiLCJkaWdlc3QiOnsiZ2l0Q29tbWl0IjoiNmIwMTdiNTNhNDQwNGY0ZmVhYjc3NmFjMTExYjBlYTlkYWNmMjczNCJ9fV19LCJydW5EZXRhaWxzIjp7ImJ1aWxkZXIiOnsiaWQiOiJodHRwczovL2dpdGh1Yi5jb20vYWN0aW9ucy9ydW5uZXIvZ2l0aHViLWhvc3RlZCJ9LCJtZXRhZGF0YSI6eyJpbnZvY2F0aW9uSWQiOiJodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5L2FjdGlvbnMvcnVucy8zNDc1NDY3MzU0Ny9hdHRlbXB0cy8xIn19fX0=", + "payloadType": "application/vnd.in-toto+json", + "signatures": [ + { + "sig": "MEUCIGmVqeu+08nY86rfgMqQIoU9pGbz8Bk4Cui/F+jo2iccAiEA0sATsTI1CHGGlRHAOsJehm6yNMoDGjDSw9xkiwjWdFI=" + } + ] + } +} diff --git a/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-engine-zxing-cpp-wasm-2.1.0.tgz.sigstore.json b/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-engine-zxing-cpp-wasm-2.1.0.tgz.sigstore.json new file mode 100644 index 0000000..b920985 --- /dev/null +++ b/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-engine-zxing-cpp-wasm-2.1.0.tgz.sigstore.json @@ -0,0 +1,60 @@ +{ + "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", + "verificationMaterial": { + "certificate": { + "rawBytes": "MIIILDCCB7KgAwIBAgIUbB6eamt9Zk510rrxkxjqECDX6u0wCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTEzMTEzMjU0WhcNMjYwOTEzMTE0MjU0WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEBl/zpi07nC0V1mC4Rw0KEy9NW1USXDcvjBH/bvXHGS9/LKTWI9KRefm9ENySZB1CncdtMuxp3mnOtdqkpPU6bKOCBtEwggbNMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUbNsEr+AGLeI6YVHd96OgXQhltgIwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wgZkGA1UdEQEB/wSBjjCBi4aBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAfBgorBgEEAYO/MAECBBF3b3JrZmxvd19kaXNwYXRjaDA2BgorBgEEAYO/MAEDBChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCkGCisGAQQBg78wAQQEG3YyLjEgQXJ0aWZhY3QgUXVhbGlmaWNhdGlvbjAjBgorBgEEAYO/MAEFBBVZYW5nanVuamllLUxpbi9TY2FubHkwOwYKKwYBBAGDvzABBgQtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTCBmgYKKwYBBAGDvzABCQSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABCgQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMB0GCisGAQQBg78wAQsEDwwNZ2l0aHViLWhvc3RlZDA4BgorBgEEAYO/MAEMBCoMKGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkwOAYKKwYBBAGDvzABDQQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMD0GCisGAQQBg78wAQ4ELwwtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MBoGCisGAQQBg78wAQ8EDAwKMTE1NjM0MjY1MzAxBgorBgEEAYO/MAEQBCMMIWh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbjAZBgorBgEEAYO/MAERBAsMCTIyNDM3MDg5ODCBmgYKKwYBBAGDvzABEgSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABEwQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCEGCisGAQQBg78wARQEEwwRd29ya2Zsb3dfZGlzcGF0Y2gwXAYKKwYBBAGDvzABFQRODExodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5L2FjdGlvbnMvcnVucy8zNDc1NDY3MzU0Ny9hdHRlbXB0cy8xMBYGCisGAQQBg78wARYECAwGcHVibGljMFwGCisGAQQBg78wARgETgxMcmVwbzpZYW5nanVuamllLUxpbi9TY2FubHk6cmVmOnJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeTCBigYKKwYBBAHWeQIEAgR8BHoAeAB2AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABoJqKrSMAAAQDAEcwRQIhAJl/nH2CnLY/qf9eq3XfHAICs4im7xYTYz3XISekwpOQAiBm7MyDjo/VYaLUSCBISt95VSqtJhWGWBOeyyFthn4VlDAKBggqhkjOPQQDAwNoADBlAjBW4fGmJg34Ev7iiOfwVRyfSdU8WqUcLROims8dtFnGl1YNL7K6NmVBM7j2yW9Nm/QCMQCeREDi0CfKlEPiV3+EbJHEXgSzJ3QFeH3kK9a4emR7zZYtxk6zDR++MG2FJgdNQoE=" + }, + "tlogEntries": [ + { + "logIndex": "2817434271", + "logId": { + "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=" + }, + "kindVersion": { + "kind": "dsse", + "version": "0.0.1" + }, + "integratedTime": "1789299174", + "inclusionPromise": { + "signedEntryTimestamp": "MEYCIQDi9vXFIOWPpdyb7/Q5StjweVEyuB9V+4q+1gPYJYTAmQIhAL9d8+Oi1jR+TlcPPp1K+w4j+/SD1I9JltSDnHH6ROp9" + }, + "inclusionProof": { + "logIndex": "2695530009", + "rootHash": "4rSTBiw4/tOtHZ9uJcC6/lkmyh7msCGWOVsHZE+dly4=", + "treeSize": "2695530024", + "hashes": [ + "Row6Jb4XNT2vwmetPyRvph/cP3d3kRBR5A4R5UOyc60=", + "XHSEeASWhglA5NP9wHDV2ovLoJx1IjFIhaZzgchUFz0=", + "3mD5H1zFjkgV0UTAWd0RsrUeXESeyYw74moYQi/+HPo=", + "SMEzsjEoza/fyilFiPpCsBIhIWIzzk+Pr+B72BHL/jQ=", + "0w8UWv51qYcrgArNuECXR+KsHlC4qdBHuko0leMj8/c=", + "O1d5tLCZI8hnj9QmvKrY6TrEIBZdP8pcsAE11aFM47g=", + "bn0+2E2n+wV44E6BldBG+EntOjWNO2XgM3PgmMwKIT0=", + "ys1AmRgOQ1cBbTrHqVAy0aCMdqJ6C/QxHXAD9GZhxmA=", + "99PoJTYgPWevn9oVlADbWdRGR90JL8Fx/FV0T06o0IA=", + "LQtwekqXPoO3KgXYEfRsV0WYK6Gk0PLLePxJWdZgThQ=", + "qOZd1StyLttRdZ9ojwet4/yO1QqFuSN2bQKQaTXLrkY=", + "uXYCZMF7lS28YUWZqw7VfMV5vdtFS6j7/bavDJtBebk=", + "S39m2eTD1rqRuAMs4r+sGsYIwW0BlTWuysWTKJ8RKVk=", + "qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=", + "xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY=" + ], + "checkpoint": { + "envelope": "rekor.sigstore.dev - 1193050959916656506\n2695530024\n4rSTBiw4/tOtHZ9uJcC6/lkmyh7msCGWOVsHZE+dly4=\n\n— rekor.sigstore.dev wNI9ajBEAiAcQyrqEi8v2eKym2K2VWCmdyySdm5v6YafLNhdQR2l3wIgdTZKPpDSnKMDkTrcWRkHx1cktZw04qg0pueW/W12Vp0=\n" + } + }, + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiMWVlOWZlODEyNzk1ZjlhZDY4ODc2NWIxYWRjMzQ2MzFlMDQ4ZGMzMjUwYjBmODdkODJlNDhjMjI3NWY1ODNmNiJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjA4ZTMxZGQwYmU2ZTViYTE2NmUxM2ZhMTkxMzRlNmQyYzRmYWMxY2JlMjMyMmExNDQ4NWY5OGJkMjNkY2QzNGYifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVRQ0lCK3ppNWtGczhZMzZzbDNabklHQ0JuNlpWUE5LOW1oTEt0MnlFclN1UzJHQWlBUHZIR0FKcmFnbU8yRlNaMFdYaForMWJKNkpud3ZEVElGSHBaVVVOYnR0UT09IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VsTVJFTkRRamRMWjBGM1NVSkJaMGxWWWtJMlpXRnRkRGxhYXpVeE1ISnllR3Q0YW5GRlEwUllOblV3ZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwOVVSWHBOVkVWNlRXcFZNRmRvWTA1TmFsbDNUMVJGZWsxVVJUQk5hbFV3VjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVkNiQzk2Y0drd04yNURNRll4YlVNMFVuY3dTMFY1T1U1WE1WVlRXRVJqZG1wQ1NDOEtZblpZU0VkVE9TOU1TMVJYU1RsTFVtVm1iVGxGVG5sVFdrSXhRMjVqWkhSTmRYaHdNMjF1VDNSa2NXdHdVRlUyWWt0UFEwSjBSWGRuWjJKT1RVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVmlUbk5GQ25JclFVZE1aVWsyV1ZaSVpEazJUMmRZVVdoc2RHZEpkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMmRhYTBkQk1WVmtSVkZGUWk5M1UwSnFha05DYVRSaFFtbEhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RRcGhiV3hzVEZWNGNHSnBPVlJaTWtaMVlraHJka3h0WkhCa1IyZ3hXV2s1TTJJelNuSmFiWGgyWkROTmRtUnFTWFZOVXpGb1kyNVNjRnB0Um1wa1F6RjRDbVJYUm5OaFYxcHdXVEpHTUdGWE9YVk1ibXgwWWtWQ2VWcFhXbnBNTW1oc1dWZFNla3d5VG5aYVIxWTBURE5aZVV4cVJYUmlia0owVEZoQ2VXSXpXbXdLWW0xR2RWa3lWWFJqYlZacVlqTmFiR051YTNkUFVWbExTM2RaUWtKQlIwUjJla0ZDUVZGUmNtRklVakJqU0UwMlRIazVNR0l5ZEd4aWFUVm9XVE5TY0FwaU1qVjZURzFrY0dSSGFERlpibFo2V2xoS2FtSXlOVEJhVnpVd1RHMU9kbUpVUVdaQ1oyOXlRbWRGUlVGWlR5OU5RVVZEUWtKR00ySXpTbkphYlhoMkNtUXhPV3RoV0U1M1dWaFNhbUZFUVRKQ1oyOXlRbWRGUlVGWlR5OU5RVVZFUWtOb2JFMXFTbXROVkVGM1RWUlplazVVV1RGTlZGa3dXbFJKZUU1RWJHMEtUMVJzYUZscVZUQmFSRVY0V1ZSWmVFMVVSVFZOZWtwcFRVTnJSME5wYzBkQlVWRkNaemM0ZDBGUlVVVkhNMWw1VEdwRloxRllTakJoVjFwb1dUTlJad3BWV0Zab1lrZHNiV0ZYVG1oa1IyeDJZbXBCYWtKbmIzSkNaMFZGUVZsUEwwMUJSVVpDUWxaYVdWYzFibUZ1Vm5WaGJXeHNURlY0Y0dKcE9WUlpNa1oxQ21KSWEzZFBkMWxMUzNkWlFrSkJSMFIyZWtGQ1FtZFJkR050Vm0xamVUbHZXbGRHYTJONU9XcGlNbEpzWlVNNU1rMXBOSGhNVnpWM1lsTXhkMk50T1RJS1dsYzFhR0p0VG14TVdFcHNXVEk1TWxwWVNqVk5SSE5IUTJselIwRlJVVUpuTnpoM1FWRm5SVXhSZDNKaFNGSXdZMGhOTmt4NU9UQmlNblJzWW1rMWFBcFpNMUp3WWpJMWVreHRaSEJrUjJneFdXNVdlbHBZU21waU1qVXdXbGMxTUV4dFRuWmlWRU5DYldkWlMwdDNXVUpDUVVkRWRucEJRa05SVTBKcGQzbENDbWxIYURCa1NFSjZUMms0ZGxveWJEQmhTRlpwVEcxT2RtSlRPVnBaVnpWdVlXNVdkV0Z0Ykd4TVZYaHdZbWs1VkZreVJuVmlTR3QyVEcxa2NHUkhhREVLV1drNU0ySXpTbkphYlhoMlpETk5kbVJxU1hWTlV6Rm9ZMjVTY0ZwdFJtcGtRekY0WkZkR2MyRlhXbkJaTWtZd1lWYzVkVXh1YkhSaVJVSjVXbGRhZWdwTU1taHNXVmRTZWt3eVRuWmFSMVkwVEROWmVVeHFSWFJpYmtKMFRGaENlV0l6V214aWJVWjFXVEpWZEdOdFZtcGlNMXBzWTI1cmQwOUJXVXRMZDFsQ0NrSkJSMFIyZWtGQ1EyZFJjVVJEYUd4TmFrcHJUVlJCZDAxVVdYcE9WRmt4VFZSWk1GcFVTWGhPUkd4dFQxUnNhRmxxVlRCYVJFVjRXVlJaZUUxVVJUVUtUWHBLYVUxQ01FZERhWE5IUVZGUlFtYzNPSGRCVVhORlJIZDNUbG95YkRCaFNGWnBURmRvZG1NelVteGFSRUUwUW1kdmNrSm5SVVZCV1U4dlRVRkZUUXBDUTI5TlMwZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNVdsbFhOVzVoYmxaMVlXMXNiRXhWZUhCaWFUbFVXVEpHZFdKSWEzZFBRVmxMQ2t0M1dVSkNRVWRFZG5wQlFrUlJVWEZFUTJoc1RXcEthMDFVUVhkTlZGbDZUbFJaTVUxVVdUQmFWRWw0VGtSc2JVOVViR2haYWxVd1drUkZlRmxVV1hnS1RWUkZOVTE2U21sTlJEQkhRMmx6UjBGUlVVSm5OemgzUVZFMFJVeDNkM1JqYlZadFkzazViMXBYUm10amVUbHFZakpTYkdWRE9USk5hVFI0VEZjMWR3cGlVekYzWTIwNU1scFhOV2hpYlU1c1RGaEtiRmt5T1RKYVdFbzFUVUp2UjBOcGMwZEJVVkZDWnpjNGQwRlJPRVZFUVhkTFRWUkZNVTVxVFRCTmFsa3hDazE2UVhoQ1oyOXlRbWRGUlVGWlR5OU5RVVZSUWtOTlRVbFhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnFRVnBDWjI5eVFtZEZSVUZaVHk5TlFVVlNRa0Z6VFVOVVNYbE9SRTB6VFVSbk5VOUVRMEp0WjFsTFMzZFpRa0pCUjBSMmVrRkNSV2RUUWdwcGQzbENhVWRvTUdSSVFucFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVXbGxYTlc1aGJsWjFZVzFzYkV4VmVIQmlhVGxVV1RKR2RXSklhM1pNYldSd0NtUkhhREZaYVRrellqTktjbHB0ZUhaa00wMTJaR3BKZFUxVE1XaGpibEp3V20xR2FtUkRNWGhrVjBaellWZGFjRmt5UmpCaFZ6bDFURzVzZEdKRlFua0tXbGRhZWt3eWFHeFpWMUo2VERKT2RscEhWalJNTTFsNVRHcEZkR0p1UW5STVdFSjVZak5hYkdKdFJuVlpNbFYwWTIxV2FtSXpXbXhqYm10M1QwRlpTd3BMZDFsQ1FrRkhSSFo2UVVKRmQxRnhSRU5vYkUxcVNtdE5WRUYzVFZSWmVrNVVXVEZOVkZrd1dsUkplRTVFYkcxUFZHeG9XV3BWTUZwRVJYaFpWRmw0Q2sxVVJUVk5la3BwVFVORlIwTnBjMGRCVVZGQ1p6YzRkMEZTVVVWRmQzZFNaREk1ZVdFeVduTmlNMlJtV2tkc2VtTkhSakJaTW1kM1dFRlpTMHQzV1VJS1FrRkhSSFo2UVVKR1VWSlBSRVY0YjJSSVVuZGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbGRYUm5WYU1uQXhZbTF3Y0ZwVE1VMWhWelIyVlRKT2FBcGliWGcxVERKR2FtUkhiSFppYmsxMlkyNVdkV041T0hwT1JHTXhUa1JaTTAxNlZUQk9lVGxvWkVoU2JHSllRakJqZVRoNFRVSlpSME5wYzBkQlVWRkNDbWMzT0hkQlVsbEZRMEYzUjJOSVZtbGlSMnhxVFVaM1IwTnBjMGRCVVZGQ1p6YzRkMEZTWjBWVVozaE5ZMjFXZDJKNmNGcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnBPVlJaTWtaMVlraHJObU50Vm0xUGJrcHNXbTVOZG1GSFZtaGFTRTEyV1RJNWExcFlaM1prYWtsMVRWTXhkV05ITUhSalNFcDJaRzFXZFFwWlZ6VnFXbE14ZVZwWFRuWmtiVlo1WlZSRFFtbG5XVXRMZDFsQ1FrRklWMlZSU1VWQloxSTRRa2h2UVdWQlFqSkJUakE1VFVkeVIzaDRSWGxaZUd0bENraEtiRzVPZDB0cFUydzJORE5xZVhRdk5HVkxZMjlCZGt0bE5rOUJRVUZDYjBweFMzSlRUVUZCUVZGRVFVVmpkMUpSU1doQlNtd3Zia2d5UTI1TVdTOEtjV1k1WlhFeldHWklRVWxEY3pScGJUZDRXVlJaZWpOWVNWTmxhM2R3VDFGQmFVSnROMDE1UkdwdkwxWlpZVXhWVTBOQ1NWTjBPVFZXVTNGMFNtaFhSd3BYUWs5bGVYbEdkR2h1TkZac1JFRkxRbWRuY1docmFrOVFVVkZFUVhkT2IwRkVRbXhCYWtKWE5HWkhiVXBuTXpSRmRqZHBhVTltZDFaU2VXWlRaRlU0Q2xkeFZXTk1VazlwYlhNNFpIUkdia2RzTVZsT1REZExOazV0VmtKTk4yb3llVmM1VG0wdlVVTk5VVU5sVWtWRWFUQkRaa3RzUlZCcFZqTXJSV0pLU0VVS1dHZFRla296VVVabFNETnJTemxoTkdWdFVqZDZXbGwwZUdzMmVrUlNLeXROUnpKR1NtZGtUbEZ2UlQwS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9XX19" + } + ], + "timestampVerificationData": {} + }, + "dsseEnvelope": { + "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoicGtnOm5wbS8lNDBzY2FubHkvZW5naW5lLXp4aW5nLWNwcC13YXNtQDIuMS4wIiwiZGlnZXN0Ijp7InNoYTUxMiI6IjQ2NzM0YzQ5Y2MwNzc2YjI2ZWRjMWZhNjI2MWY3OGEwMjhhNmRkMGVjOTdhNzQzM2NkMjIxMDE2NDg4MzZmYWViYTA0YzU0N2U5MDUxMDM3MmZhN2RhNDEzM2QwMzAzZjg1MTE4Y2VjMmIxNzEwMDU4MWExNjBjYjA0N2JiYzM5In19XSwicHJlZGljYXRlVHlwZSI6Imh0dHBzOi8vc2xzYS5kZXYvcHJvdmVuYW5jZS92MSIsInByZWRpY2F0ZSI6eyJidWlsZERlZmluaXRpb24iOnsiYnVpbGRUeXBlIjoiaHR0cHM6Ly9zbHNhLWZyYW1ld29yay5naXRodWIuaW8vZ2l0aHViLWFjdGlvbnMtYnVpbGR0eXBlcy93b3JrZmxvdy92MSIsImV4dGVybmFsUGFyYW1ldGVycyI6eyJ3b3JrZmxvdyI6eyJyZWYiOiJyZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkiLCJyZXBvc2l0b3J5IjoiaHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seSIsInBhdGgiOiIuZ2l0aHViL3dvcmtmbG93cy92Mi4xLWFydGlmYWN0LXF1YWxpZmljYXRpb24ueW1sIn0sInNvdXJjZV9jb21taXQiOiI2YjAxN2I1M2E0NDA0ZjRmZWFiNzc2YWMxMTFiMGVhOWRhY2YyNzM0In0sImludGVybmFsUGFyYW1ldGVycyI6eyJnaXRodWIiOnsiZXZlbnRfbmFtZSI6IndvcmtmbG93X2Rpc3BhdGNoIiwicmVwb3NpdG9yeV9pZCI6IjExNTYzNDI2NTMiLCJyZXBvc2l0b3J5X293bmVyX2lkIjoiMjI0MzcwODk4In19LCJyZXNvbHZlZERlcGVuZGVuY2llcyI6W3sidXJpIjoiZ2l0K2h0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHlAcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5IiwiZGlnZXN0Ijp7ImdpdENvbW1pdCI6ImUyMmQxMDAxNjM1NjUxNjRlMjE0OWY5OWFiNTRkMTFhNjExMTkzMmIifX0seyJ1cmkiOiJnaXQraHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seUA2YjAxN2I1M2E0NDA0ZjRmZWFiNzc2YWMxMTFiMGVhOWRhY2YyNzM0IiwiZGlnZXN0Ijp7ImdpdENvbW1pdCI6IjZiMDE3YjUzYTQ0MDRmNGZlYWI3NzZhYzExMWIwZWE5ZGFjZjI3MzQifX1dfSwicnVuRGV0YWlscyI6eyJidWlsZGVyIjp7ImlkIjoiaHR0cHM6Ly9naXRodWIuY29tL2FjdGlvbnMvcnVubmVyL2dpdGh1Yi1ob3N0ZWQifSwibWV0YWRhdGEiOnsiaW52b2NhdGlvbklkIjoiaHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seS9hY3Rpb25zL3J1bnMvMzQ3NTQ2NzM1NDcvYXR0ZW1wdHMvMSJ9fX19", + "payloadType": "application/vnd.in-toto+json", + "signatures": [ + { + "sig": "MEQCIB+zi5kFs8Y36sl3ZnIGCBn6ZVPNK9mhLKt2yErSuS2GAiAPvHGAJragmO2FSZ0WXhZ+1bJ6JnwvDTIFHpZUUNbttQ==" + } + ] + } +} diff --git a/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-engine-zxing-js-2.1.0.tgz.sigstore.json b/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-engine-zxing-js-2.1.0.tgz.sigstore.json new file mode 100644 index 0000000..77558eb --- /dev/null +++ b/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-engine-zxing-js-2.1.0.tgz.sigstore.json @@ -0,0 +1,59 @@ +{ + "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", + "verificationMaterial": { + "certificate": { + "rawBytes": "MIIILDCCB7KgAwIBAgIUEwOz+J2atJLaHRIEBH0JKQXNoHkwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTEzMTEzMjU1WhcNMjYwOTEzMTE0MjU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEz5RrxK5LLM5wTtZtS+/4SROcKOx+98ZdipENJbNslCxcD/zY64YJys1RODObNPrxUxU0FOLghEH0lNK2qhWKQKOCBtEwggbNMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQU3PnbtHAWqAMe1l+oDSmPdDizp0UwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wgZkGA1UdEQEB/wSBjjCBi4aBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAfBgorBgEEAYO/MAECBBF3b3JrZmxvd19kaXNwYXRjaDA2BgorBgEEAYO/MAEDBChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCkGCisGAQQBg78wAQQEG3YyLjEgQXJ0aWZhY3QgUXVhbGlmaWNhdGlvbjAjBgorBgEEAYO/MAEFBBVZYW5nanVuamllLUxpbi9TY2FubHkwOwYKKwYBBAGDvzABBgQtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTCBmgYKKwYBBAGDvzABCQSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABCgQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMB0GCisGAQQBg78wAQsEDwwNZ2l0aHViLWhvc3RlZDA4BgorBgEEAYO/MAEMBCoMKGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkwOAYKKwYBBAGDvzABDQQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMD0GCisGAQQBg78wAQ4ELwwtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MBoGCisGAQQBg78wAQ8EDAwKMTE1NjM0MjY1MzAxBgorBgEEAYO/MAEQBCMMIWh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbjAZBgorBgEEAYO/MAERBAsMCTIyNDM3MDg5ODCBmgYKKwYBBAGDvzABEgSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABEwQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCEGCisGAQQBg78wARQEEwwRd29ya2Zsb3dfZGlzcGF0Y2gwXAYKKwYBBAGDvzABFQRODExodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5L2FjdGlvbnMvcnVucy8zNDc1NDY3MzU0Ny9hdHRlbXB0cy8xMBYGCisGAQQBg78wARYECAwGcHVibGljMFwGCisGAQQBg78wARgETgxMcmVwbzpZYW5nanVuamllLUxpbi9TY2FubHk6cmVmOnJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeTCBigYKKwYBBAHWeQIEAgR8BHoAeAB2AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABoJqKsO0AAAQDAEcwRQIhAO3wiH7k0B2f1OcweD6jKhFiYorqGNdgudFk4FZYwMLxAiAGJw2KTA1SuAu9SkP7NRdSylR4exLZ7ff+gmJLsJyVqTAKBggqhkjOPQQDAwNoADBlAjEAqwYD6uYlsDbTOuDzSZKKpX3N2CEOjLh8r22rmIE5NZ9mHpqiM5wGfJ3s2gqqP9o+AjBOU8Wwmkpu9QveNKXm9u5UAgJPi3s1vPeIxS0y676am8fOEJjcNwWs9SZH7tto8Tk=" + }, + "tlogEntries": [ + { + "logIndex": "2817434380", + "logId": { + "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=" + }, + "kindVersion": { + "kind": "dsse", + "version": "0.0.1" + }, + "integratedTime": "1789299175", + "inclusionPromise": { + "signedEntryTimestamp": "MEUCIQCOCqtFQMtBRRquDoOJkmMWfrPP1vIOONTThEdkj2DAhwIgKk/4LQPvco5DaxTtP8QYoQuhlvWmF/jji/Ef5vUHkSA=" + }, + "inclusionProof": { + "logIndex": "2695530118", + "rootHash": "mNqTQa4W7xsXrtOz2spH5ljosP+/zxxeIfKuVOpWdj8=", + "treeSize": "2695530124", + "hashes": [ + "yIzpuZk6qS35wrgx/iR2TdEOrBHmh/0chdlafanMFI8=", + "Mz8lLa0e43LQbrgtLlP7+VExZRLRC9+m7XWIIoxClbc=", + "2BSSXfFMh7nkJiVHSae7mwPKPt5AybmIoNoSZFddygg=", + "pcsucyUG1RRLosgfN/Hau+4y70LhAyRTdBoHxtZm66A=", + "09xWaDdKLwNFYlJwBzktGgVJASEYxGpxYrAGR/nlZrg=", + "bn0+2E2n+wV44E6BldBG+EntOjWNO2XgM3PgmMwKIT0=", + "ys1AmRgOQ1cBbTrHqVAy0aCMdqJ6C/QxHXAD9GZhxmA=", + "99PoJTYgPWevn9oVlADbWdRGR90JL8Fx/FV0T06o0IA=", + "LQtwekqXPoO3KgXYEfRsV0WYK6Gk0PLLePxJWdZgThQ=", + "qOZd1StyLttRdZ9ojwet4/yO1QqFuSN2bQKQaTXLrkY=", + "uXYCZMF7lS28YUWZqw7VfMV5vdtFS6j7/bavDJtBebk=", + "S39m2eTD1rqRuAMs4r+sGsYIwW0BlTWuysWTKJ8RKVk=", + "qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=", + "xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY=" + ], + "checkpoint": { + "envelope": "rekor.sigstore.dev - 1193050959916656506\n2695530124\nmNqTQa4W7xsXrtOz2spH5ljosP+/zxxeIfKuVOpWdj8=\n\n— rekor.sigstore.dev wNI9ajBGAiEAvH8b/wsQha1hZl/g0kUWMqkNc8Hn0gTxRXzX9NNzgeoCIQCjsvBdBQgQY+FBeJZmGf/mIJY0FFOnDYWTdXQGOfOwsQ==\n" + } + }, + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiYTE5MjE0MjcxYTQ0ZTE2MmI1MTBmZTdjZmFiNDBmYzM2OWJiMDA4ZGI1NjQxY2QyMDkzMDYwOGU2ZGUzYjkwZiJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImE0ZmY4Y2M1NTNlNWZmYTdmYWFlMTk1NmNmYzAxOWE1OWQ3OWFkZDM5ZGY1ZjhlYzJiNmM0NGJiOGIwMDk2MjMifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVVQ0lRRENFZ1hUNE5JMWYrdU4rWnFzTHloUHQ3cytta3lPS0xKeVJaZmU5RVJZTkFJZ1JmM1QrTDhRTTUwVHRSQlpRZGp0bFpuR0k4VndCSkFuNzZOS29ienp6WXM9IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VsTVJFTkRRamRMWjBGM1NVSkJaMGxWUlhkUGVpdEtNbUYwU2t4aFNGSkpSVUpJTUVwTFVWaE9iMGhyZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwOVVSWHBOVkVWNlRXcFZNVmRvWTA1TmFsbDNUMVJGZWsxVVJUQk5hbFV4VjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVjZOVkp5ZUVzMVRFeE5OWGRVZEZwMFV5c3ZORk5TVDJOTFQzZ3JPVGhhWkdsd1JVNEtTbUpPYzJ4RGVHTkVMM3BaTmpSWlNubHpNVkpQUkU5aVRsQnllRlY0VlRCR1QweG5hRVZJTUd4T1N6SnhhRmRMVVV0UFEwSjBSWGRuWjJKT1RVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVXpVRzVpQ25SSVFWZHhRVTFsTVd3cmIwUlRiVkJrUkdsNmNEQlZkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMmRhYTBkQk1WVmtSVkZGUWk5M1UwSnFha05DYVRSaFFtbEhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RRcGhiV3hzVEZWNGNHSnBPVlJaTWtaMVlraHJka3h0WkhCa1IyZ3hXV2s1TTJJelNuSmFiWGgyWkROTmRtUnFTWFZOVXpGb1kyNVNjRnB0Um1wa1F6RjRDbVJYUm5OaFYxcHdXVEpHTUdGWE9YVk1ibXgwWWtWQ2VWcFhXbnBNTW1oc1dWZFNla3d5VG5aYVIxWTBURE5aZVV4cVJYUmlia0owVEZoQ2VXSXpXbXdLWW0xR2RWa3lWWFJqYlZacVlqTmFiR051YTNkUFVWbExTM2RaUWtKQlIwUjJla0ZDUVZGUmNtRklVakJqU0UwMlRIazVNR0l5ZEd4aWFUVm9XVE5TY0FwaU1qVjZURzFrY0dSSGFERlpibFo2V2xoS2FtSXlOVEJhVnpVd1RHMU9kbUpVUVdaQ1oyOXlRbWRGUlVGWlR5OU5RVVZEUWtKR00ySXpTbkphYlhoMkNtUXhPV3RoV0U1M1dWaFNhbUZFUVRKQ1oyOXlRbWRGUlVGWlR5OU5RVVZFUWtOb2JFMXFTbXROVkVGM1RWUlplazVVV1RGTlZGa3dXbFJKZUU1RWJHMEtUMVJzYUZscVZUQmFSRVY0V1ZSWmVFMVVSVFZOZWtwcFRVTnJSME5wYzBkQlVWRkNaemM0ZDBGUlVVVkhNMWw1VEdwRloxRllTakJoVjFwb1dUTlJad3BWV0Zab1lrZHNiV0ZYVG1oa1IyeDJZbXBCYWtKbmIzSkNaMFZGUVZsUEwwMUJSVVpDUWxaYVdWYzFibUZ1Vm5WaGJXeHNURlY0Y0dKcE9WUlpNa1oxQ21KSWEzZFBkMWxMUzNkWlFrSkJSMFIyZWtGQ1FtZFJkR050Vm0xamVUbHZXbGRHYTJONU9XcGlNbEpzWlVNNU1rMXBOSGhNVnpWM1lsTXhkMk50T1RJS1dsYzFhR0p0VG14TVdFcHNXVEk1TWxwWVNqVk5SSE5IUTJselIwRlJVVUpuTnpoM1FWRm5SVXhSZDNKaFNGSXdZMGhOTmt4NU9UQmlNblJzWW1rMWFBcFpNMUp3WWpJMWVreHRaSEJrUjJneFdXNVdlbHBZU21waU1qVXdXbGMxTUV4dFRuWmlWRU5DYldkWlMwdDNXVUpDUVVkRWRucEJRa05SVTBKcGQzbENDbWxIYURCa1NFSjZUMms0ZGxveWJEQmhTRlpwVEcxT2RtSlRPVnBaVnpWdVlXNVdkV0Z0Ykd4TVZYaHdZbWs1VkZreVJuVmlTR3QyVEcxa2NHUkhhREVLV1drNU0ySXpTbkphYlhoMlpETk5kbVJxU1hWTlV6Rm9ZMjVTY0ZwdFJtcGtRekY0WkZkR2MyRlhXbkJaTWtZd1lWYzVkVXh1YkhSaVJVSjVXbGRhZWdwTU1taHNXVmRTZWt3eVRuWmFSMVkwVEROWmVVeHFSWFJpYmtKMFRGaENlV0l6V214aWJVWjFXVEpWZEdOdFZtcGlNMXBzWTI1cmQwOUJXVXRMZDFsQ0NrSkJSMFIyZWtGQ1EyZFJjVVJEYUd4TmFrcHJUVlJCZDAxVVdYcE9WRmt4VFZSWk1GcFVTWGhPUkd4dFQxUnNhRmxxVlRCYVJFVjRXVlJaZUUxVVJUVUtUWHBLYVUxQ01FZERhWE5IUVZGUlFtYzNPSGRCVVhORlJIZDNUbG95YkRCaFNGWnBURmRvZG1NelVteGFSRUUwUW1kdmNrSm5SVVZCV1U4dlRVRkZUUXBDUTI5TlMwZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNVdsbFhOVzVoYmxaMVlXMXNiRXhWZUhCaWFUbFVXVEpHZFdKSWEzZFBRVmxMQ2t0M1dVSkNRVWRFZG5wQlFrUlJVWEZFUTJoc1RXcEthMDFVUVhkTlZGbDZUbFJaTVUxVVdUQmFWRWw0VGtSc2JVOVViR2haYWxVd1drUkZlRmxVV1hnS1RWUkZOVTE2U21sTlJEQkhRMmx6UjBGUlVVSm5OemgzUVZFMFJVeDNkM1JqYlZadFkzazViMXBYUm10amVUbHFZakpTYkdWRE9USk5hVFI0VEZjMWR3cGlVekYzWTIwNU1scFhOV2hpYlU1c1RGaEtiRmt5T1RKYVdFbzFUVUp2UjBOcGMwZEJVVkZDWnpjNGQwRlJPRVZFUVhkTFRWUkZNVTVxVFRCTmFsa3hDazE2UVhoQ1oyOXlRbWRGUlVGWlR5OU5RVVZSUWtOTlRVbFhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnFRVnBDWjI5eVFtZEZSVUZaVHk5TlFVVlNRa0Z6VFVOVVNYbE9SRTB6VFVSbk5VOUVRMEp0WjFsTFMzZFpRa0pCUjBSMmVrRkNSV2RUUWdwcGQzbENhVWRvTUdSSVFucFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVXbGxYTlc1aGJsWjFZVzFzYkV4VmVIQmlhVGxVV1RKR2RXSklhM1pNYldSd0NtUkhhREZaYVRrellqTktjbHB0ZUhaa00wMTJaR3BKZFUxVE1XaGpibEp3V20xR2FtUkRNWGhrVjBaellWZGFjRmt5UmpCaFZ6bDFURzVzZEdKRlFua0tXbGRhZWt3eWFHeFpWMUo2VERKT2RscEhWalJNTTFsNVRHcEZkR0p1UW5STVdFSjVZak5hYkdKdFJuVlpNbFYwWTIxV2FtSXpXbXhqYm10M1QwRlpTd3BMZDFsQ1FrRkhSSFo2UVVKRmQxRnhSRU5vYkUxcVNtdE5WRUYzVFZSWmVrNVVXVEZOVkZrd1dsUkplRTVFYkcxUFZHeG9XV3BWTUZwRVJYaFpWRmw0Q2sxVVJUVk5la3BwVFVORlIwTnBjMGRCVVZGQ1p6YzRkMEZTVVVWRmQzZFNaREk1ZVdFeVduTmlNMlJtV2tkc2VtTkhSakJaTW1kM1dFRlpTMHQzV1VJS1FrRkhSSFo2UVVKR1VWSlBSRVY0YjJSSVVuZGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbGRYUm5WYU1uQXhZbTF3Y0ZwVE1VMWhWelIyVlRKT2FBcGliWGcxVERKR2FtUkhiSFppYmsxMlkyNVdkV041T0hwT1JHTXhUa1JaTTAxNlZUQk9lVGxvWkVoU2JHSllRakJqZVRoNFRVSlpSME5wYzBkQlVWRkNDbWMzT0hkQlVsbEZRMEYzUjJOSVZtbGlSMnhxVFVaM1IwTnBjMGRCVVZGQ1p6YzRkMEZTWjBWVVozaE5ZMjFXZDJKNmNGcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnBPVlJaTWtaMVlraHJObU50Vm0xUGJrcHNXbTVOZG1GSFZtaGFTRTEyV1RJNWExcFlaM1prYWtsMVRWTXhkV05ITUhSalNFcDJaRzFXZFFwWlZ6VnFXbE14ZVZwWFRuWmtiVlo1WlZSRFFtbG5XVXRMZDFsQ1FrRklWMlZSU1VWQloxSTRRa2h2UVdWQlFqSkJUakE1VFVkeVIzaDRSWGxaZUd0bENraEtiRzVPZDB0cFUydzJORE5xZVhRdk5HVkxZMjlCZGt0bE5rOUJRVUZDYjBweFMzTlBNRUZCUVZGRVFVVmpkMUpSU1doQlR6TjNhVWczYXpCQ01tWUtNVTlqZDJWRU5tcExhRVpwV1c5eWNVZE9aR2QxWkVack5FWmFXWGROVEhoQmFVRkhTbmN5UzFSQk1WTjFRWFU1VTJ0UU4wNVNaRk41YkZJMFpYaE1XZ28zWm1ZcloyMUtUSE5LZVZaeFZFRkxRbWRuY1docmFrOVFVVkZFUVhkT2IwRkVRbXhCYWtWQmNYZFpSRFoxV1d4elJHSlVUM1ZFZWxOYVMwdHdXRE5PQ2pKRFJVOXFUR2c0Y2pJeWNtMUpSVFZPV2psdFNIQnhhVTAxZDBkbVNqTnpNbWR4Y1ZBNWJ5dEJha0pQVlRoWGQyMXJjSFU1VVhabFRrdFliVGwxTlZVS1FXZEtVR2t6Y3pGMlVHVkplRk13ZVRZM05tRnRPR1pQUlVwcVkwNTNWM001VTFwSU4zUjBiemhVYXowS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9XX19" + } + ], + "timestampVerificationData": {} + }, + "dsseEnvelope": { + "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoicGtnOm5wbS8lNDBzY2FubHkvZW5naW5lLXp4aW5nLWpzQDIuMS4wIiwiZGlnZXN0Ijp7InNoYTUxMiI6IjQ5YTdjNjNkZGY2MzE3Yjk2NjJmMWJlNDVkOTJiOGVhOTI4OWZiYjUxZDRkMzY0YTVjMWUzZTg5OWU4MjEwMWFmZDI2OGQyNmE4YWYyNWNiOGE3MzliZDRkMjEzZjIzZWE0OTlkNGNiNWIwMGU5NWZmZjZkYzdjZmNmMGQwZmRhIn19XSwicHJlZGljYXRlVHlwZSI6Imh0dHBzOi8vc2xzYS5kZXYvcHJvdmVuYW5jZS92MSIsInByZWRpY2F0ZSI6eyJidWlsZERlZmluaXRpb24iOnsiYnVpbGRUeXBlIjoiaHR0cHM6Ly9zbHNhLWZyYW1ld29yay5naXRodWIuaW8vZ2l0aHViLWFjdGlvbnMtYnVpbGR0eXBlcy93b3JrZmxvdy92MSIsImV4dGVybmFsUGFyYW1ldGVycyI6eyJ3b3JrZmxvdyI6eyJyZWYiOiJyZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkiLCJyZXBvc2l0b3J5IjoiaHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seSIsInBhdGgiOiIuZ2l0aHViL3dvcmtmbG93cy92Mi4xLWFydGlmYWN0LXF1YWxpZmljYXRpb24ueW1sIn0sInNvdXJjZV9jb21taXQiOiI2YjAxN2I1M2E0NDA0ZjRmZWFiNzc2YWMxMTFiMGVhOWRhY2YyNzM0In0sImludGVybmFsUGFyYW1ldGVycyI6eyJnaXRodWIiOnsiZXZlbnRfbmFtZSI6IndvcmtmbG93X2Rpc3BhdGNoIiwicmVwb3NpdG9yeV9pZCI6IjExNTYzNDI2NTMiLCJyZXBvc2l0b3J5X293bmVyX2lkIjoiMjI0MzcwODk4In19LCJyZXNvbHZlZERlcGVuZGVuY2llcyI6W3sidXJpIjoiZ2l0K2h0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHlAcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5IiwiZGlnZXN0Ijp7ImdpdENvbW1pdCI6ImUyMmQxMDAxNjM1NjUxNjRlMjE0OWY5OWFiNTRkMTFhNjExMTkzMmIifX0seyJ1cmkiOiJnaXQraHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seUA2YjAxN2I1M2E0NDA0ZjRmZWFiNzc2YWMxMTFiMGVhOWRhY2YyNzM0IiwiZGlnZXN0Ijp7ImdpdENvbW1pdCI6IjZiMDE3YjUzYTQ0MDRmNGZlYWI3NzZhYzExMWIwZWE5ZGFjZjI3MzQifX1dfSwicnVuRGV0YWlscyI6eyJidWlsZGVyIjp7ImlkIjoiaHR0cHM6Ly9naXRodWIuY29tL2FjdGlvbnMvcnVubmVyL2dpdGh1Yi1ob3N0ZWQifSwibWV0YWRhdGEiOnsiaW52b2NhdGlvbklkIjoiaHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seS9hY3Rpb25zL3J1bnMvMzQ3NTQ2NzM1NDcvYXR0ZW1wdHMvMSJ9fX19", + "payloadType": "application/vnd.in-toto+json", + "signatures": [ + { + "sig": "MEUCIQDCEgXT4NI1f+uN+ZqsLyhPt7s+mkyOKLJyRZfe9ERYNAIgRf3T+L8QM50TtRBZQdjtlZnGI8VwBJAn76NKobzzzYs=" + } + ] + } +} diff --git a/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-node-2.1.0.tgz.sigstore.json b/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-node-2.1.0.tgz.sigstore.json new file mode 100644 index 0000000..b913ead --- /dev/null +++ b/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-node-2.1.0.tgz.sigstore.json @@ -0,0 +1,61 @@ +{ + "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", + "verificationMaterial": { + "certificate": { + "rawBytes": "MIIILjCCB7OgAwIBAgIUCqoUGSA3C+Bs6gBA1YBYdXprUNkwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTEzMTEzMjQ5WhcNMjYwOTEzMTE0MjQ5WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEwvZ9sohtU5YWt149GDyYn6wD6yM35kQd+p8sw5+JJE6aDj9tIyB3Z6nq1BHpkCL9U9LXx/ni2sfXA0rnnzslWaOCBtIwggbOMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUt/wFnQ8oYVpui8oGVQevRQJaLZswHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wgZkGA1UdEQEB/wSBjjCBi4aBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAfBgorBgEEAYO/MAECBBF3b3JrZmxvd19kaXNwYXRjaDA2BgorBgEEAYO/MAEDBChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCkGCisGAQQBg78wAQQEG3YyLjEgQXJ0aWZhY3QgUXVhbGlmaWNhdGlvbjAjBgorBgEEAYO/MAEFBBVZYW5nanVuamllLUxpbi9TY2FubHkwOwYKKwYBBAGDvzABBgQtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTCBmgYKKwYBBAGDvzABCQSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABCgQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMB0GCisGAQQBg78wAQsEDwwNZ2l0aHViLWhvc3RlZDA4BgorBgEEAYO/MAEMBCoMKGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkwOAYKKwYBBAGDvzABDQQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMD0GCisGAQQBg78wAQ4ELwwtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MBoGCisGAQQBg78wAQ8EDAwKMTE1NjM0MjY1MzAxBgorBgEEAYO/MAEQBCMMIWh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbjAZBgorBgEEAYO/MAERBAsMCTIyNDM3MDg5ODCBmgYKKwYBBAGDvzABEgSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABEwQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCEGCisGAQQBg78wARQEEwwRd29ya2Zsb3dfZGlzcGF0Y2gwXAYKKwYBBAGDvzABFQRODExodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5L2FjdGlvbnMvcnVucy8zNDc1NDY3MzU0Ny9hdHRlbXB0cy8xMBYGCisGAQQBg78wARYECAwGcHVibGljMFwGCisGAQQBg78wARgETgxMcmVwbzpZYW5nanVuamllLUxpbi9TY2FubHk6cmVmOnJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeTCBiwYKKwYBBAHWeQIEAgR9BHsAeQB3AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABoJqKl0IAAAQDAEgwRgIhAKO/1yWZpsUyV/0B8yuNgPRUZxLS2/NpQDF7xtL/ii0TAiEA6K/FkebLlKmBNhEB11LLmBewb4uqHYe/oKFQrX8IGrowCgYIKoZIzj0EAwMDaQAwZgIxAPuLf1DDrMvij4L86ZN7dgGJHajmpbg2kZx9Ru6bX536tofd6tkTr7Inas44otlWAQIxALNkpiQRbO2GvUGesDAsJb+4dBC6PBoLu7suLxgAQKhsyxnd6BY1efZj8T8U2KU29g==" + }, + "tlogEntries": [ + { + "logIndex": "2817433625", + "logId": { + "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=" + }, + "kindVersion": { + "kind": "dsse", + "version": "0.0.1" + }, + "integratedTime": "1789299169", + "inclusionPromise": { + "signedEntryTimestamp": "MEQCIEKJI71x/HJqu1Wf+rgsrH4wx868SzjpGuY0fVh2xjzrAiBCCLjD8HF+lWjWNHdGXUvVoojapssspUflu6r5XEXH8g==" + }, + "inclusionProof": { + "logIndex": "2695529363", + "rootHash": "KEC6nvPCHoDW3yZ1F3n/hrZ+HtyMt6z93s9012bbEhM=", + "treeSize": "2695529378", + "hashes": [ + "p37MirXwRCCGhWYudz8ylvPwNeIQWo/IL4fOohw5rLE=", + "QxjkNFArWZPImPYYg+GqwnVYh1DSV624VGVUPHLLkEc=", + "Wkxt4EGe4AkklS+tLQ2n8Xybw9avFAnR2LB17vekLkU=", + "JmkAqZPGDv3Q/gqIYIQtyP7XNahHbyMHNv1Q45rXRrA=", + "aJF1oFCNIbFULWH004W3U6jykWH4Lv9pL4+U6lyHO6c=", + "XIDR6f1FQWL86tVjJPUqNxFHUHqjFlhoO9pFHH4OF/0=", + "rrJ+IT6Ox7bGvTZMhVYGUysc0kgPwEDx+bWNiC2B29k=", + "ehRgb+TFDrmRrXHfwZdtb/xHcytPVqjwJrGxtpYgXY8=", + "JB/RNmp6kfQ4AFK/yjP1W28cn5xu4p4PvAGOfnm1q5c=", + "99PoJTYgPWevn9oVlADbWdRGR90JL8Fx/FV0T06o0IA=", + "LQtwekqXPoO3KgXYEfRsV0WYK6Gk0PLLePxJWdZgThQ=", + "qOZd1StyLttRdZ9ojwet4/yO1QqFuSN2bQKQaTXLrkY=", + "uXYCZMF7lS28YUWZqw7VfMV5vdtFS6j7/bavDJtBebk=", + "S39m2eTD1rqRuAMs4r+sGsYIwW0BlTWuysWTKJ8RKVk=", + "qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=", + "xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY=" + ], + "checkpoint": { + "envelope": "rekor.sigstore.dev - 1193050959916656506\n2695529378\nKEC6nvPCHoDW3yZ1F3n/hrZ+HtyMt6z93s9012bbEhM=\n\n— rekor.sigstore.dev wNI9ajBEAiAmvoh5mGGp9EHwJpxPh2GSXewFbDGFbyKDQqMdWKpCmgIgOZKF26vvIUiEw7tQ8DztWqMTx1PceQrz2lLFMvW8hLQ=\n" + } + }, + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiZmU2YWY5N2Y1MjJhY2Y4NDA2NTdhZmNkOTQ0NTAwMzdlYzVkMTI1MTQ1YjJkNTA1Y2FiNzkzN2FkN2UwNDYxZCJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjNhMDk5YjkyMmYwZjFmNmY5NWJkZGE4ODQxOGFkYWMyYTFkMDJhZGM2YmI3NDk3ZjhmNmU0Yjg0N2Y0NmEzOGUifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVVQ0lHV2ozTkdkYWJEN2p6U2lVakJ5dUZzRDBPc2h1ZTB2NVd2MHEvNlUvUXBQQWlFQTVjUFIyc3BUME1Mb3FaNFZrM09BMFFKSnA5dzNCWXNwZlpaQS9rR1dMZGc9IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VsTWFrTkRRamRQWjBGM1NVSkJaMGxWUTNGdlZVZFRRVE5ESzBKek5tZENRVEZaUWxsa1dIQnlWVTVyZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwOVVSWHBOVkVWNlRXcFJOVmRvWTA1TmFsbDNUMVJGZWsxVVJUQk5hbEUxVjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVjNkbG81YzI5b2RGVTFXVmQwTVRRNVIwUjVXVzQyZDBRMmVVMHpOV3RSWkN0d09ITUtkelVyU2twRk5tRkVhamwwU1hsQ00xbzJibkV4UWtod2EwTk1PVlU1VEZoNEwyNXBNbk5tV0VFd2NtNXVlbk5zVjJGUFEwSjBTWGRuWjJKUFRVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVjBMM2RHQ201Uk9HOVpWbkIxYVRodlIxWlJaWFpTVVVwaFRGcHpkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMmRhYTBkQk1WVmtSVkZGUWk5M1UwSnFha05DYVRSaFFtbEhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RRcGhiV3hzVEZWNGNHSnBPVlJaTWtaMVlraHJka3h0WkhCa1IyZ3hXV2s1TTJJelNuSmFiWGgyWkROTmRtUnFTWFZOVXpGb1kyNVNjRnB0Um1wa1F6RjRDbVJYUm5OaFYxcHdXVEpHTUdGWE9YVk1ibXgwWWtWQ2VWcFhXbnBNTW1oc1dWZFNla3d5VG5aYVIxWTBURE5aZVV4cVJYUmlia0owVEZoQ2VXSXpXbXdLWW0xR2RWa3lWWFJqYlZacVlqTmFiR051YTNkUFVWbExTM2RaUWtKQlIwUjJla0ZDUVZGUmNtRklVakJqU0UwMlRIazVNR0l5ZEd4aWFUVm9XVE5TY0FwaU1qVjZURzFrY0dSSGFERlpibFo2V2xoS2FtSXlOVEJhVnpVd1RHMU9kbUpVUVdaQ1oyOXlRbWRGUlVGWlR5OU5RVVZEUWtKR00ySXpTbkphYlhoMkNtUXhPV3RoV0U1M1dWaFNhbUZFUVRKQ1oyOXlRbWRGUlVGWlR5OU5RVVZFUWtOb2JFMXFTbXROVkVGM1RWUlplazVVV1RGTlZGa3dXbFJKZUU1RWJHMEtUMVJzYUZscVZUQmFSRVY0V1ZSWmVFMVVSVFZOZWtwcFRVTnJSME5wYzBkQlVWRkNaemM0ZDBGUlVVVkhNMWw1VEdwRloxRllTakJoVjFwb1dUTlJad3BWV0Zab1lrZHNiV0ZYVG1oa1IyeDJZbXBCYWtKbmIzSkNaMFZGUVZsUEwwMUJSVVpDUWxaYVdWYzFibUZ1Vm5WaGJXeHNURlY0Y0dKcE9WUlpNa1oxQ21KSWEzZFBkMWxMUzNkWlFrSkJSMFIyZWtGQ1FtZFJkR050Vm0xamVUbHZXbGRHYTJONU9XcGlNbEpzWlVNNU1rMXBOSGhNVnpWM1lsTXhkMk50T1RJS1dsYzFhR0p0VG14TVdFcHNXVEk1TWxwWVNqVk5SSE5IUTJselIwRlJVVUpuTnpoM1FWRm5SVXhSZDNKaFNGSXdZMGhOTmt4NU9UQmlNblJzWW1rMWFBcFpNMUp3WWpJMWVreHRaSEJrUjJneFdXNVdlbHBZU21waU1qVXdXbGMxTUV4dFRuWmlWRU5DYldkWlMwdDNXVUpDUVVkRWRucEJRa05SVTBKcGQzbENDbWxIYURCa1NFSjZUMms0ZGxveWJEQmhTRlpwVEcxT2RtSlRPVnBaVnpWdVlXNVdkV0Z0Ykd4TVZYaHdZbWs1VkZreVJuVmlTR3QyVEcxa2NHUkhhREVLV1drNU0ySXpTbkphYlhoMlpETk5kbVJxU1hWTlV6Rm9ZMjVTY0ZwdFJtcGtRekY0WkZkR2MyRlhXbkJaTWtZd1lWYzVkVXh1YkhSaVJVSjVXbGRhZWdwTU1taHNXVmRTZWt3eVRuWmFSMVkwVEROWmVVeHFSWFJpYmtKMFRGaENlV0l6V214aWJVWjFXVEpWZEdOdFZtcGlNMXBzWTI1cmQwOUJXVXRMZDFsQ0NrSkJSMFIyZWtGQ1EyZFJjVVJEYUd4TmFrcHJUVlJCZDAxVVdYcE9WRmt4VFZSWk1GcFVTWGhPUkd4dFQxUnNhRmxxVlRCYVJFVjRXVlJaZUUxVVJUVUtUWHBLYVUxQ01FZERhWE5IUVZGUlFtYzNPSGRCVVhORlJIZDNUbG95YkRCaFNGWnBURmRvZG1NelVteGFSRUUwUW1kdmNrSm5SVVZCV1U4dlRVRkZUUXBDUTI5TlMwZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNVdsbFhOVzVoYmxaMVlXMXNiRXhWZUhCaWFUbFVXVEpHZFdKSWEzZFBRVmxMQ2t0M1dVSkNRVWRFZG5wQlFrUlJVWEZFUTJoc1RXcEthMDFVUVhkTlZGbDZUbFJaTVUxVVdUQmFWRWw0VGtSc2JVOVViR2haYWxVd1drUkZlRmxVV1hnS1RWUkZOVTE2U21sTlJEQkhRMmx6UjBGUlVVSm5OemgzUVZFMFJVeDNkM1JqYlZadFkzazViMXBYUm10amVUbHFZakpTYkdWRE9USk5hVFI0VEZjMWR3cGlVekYzWTIwNU1scFhOV2hpYlU1c1RGaEtiRmt5T1RKYVdFbzFUVUp2UjBOcGMwZEJVVkZDWnpjNGQwRlJPRVZFUVhkTFRWUkZNVTVxVFRCTmFsa3hDazE2UVhoQ1oyOXlRbWRGUlVGWlR5OU5RVVZSUWtOTlRVbFhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnFRVnBDWjI5eVFtZEZSVUZaVHk5TlFVVlNRa0Z6VFVOVVNYbE9SRTB6VFVSbk5VOUVRMEp0WjFsTFMzZFpRa0pCUjBSMmVrRkNSV2RUUWdwcGQzbENhVWRvTUdSSVFucFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVXbGxYTlc1aGJsWjFZVzFzYkV4VmVIQmlhVGxVV1RKR2RXSklhM1pNYldSd0NtUkhhREZaYVRrellqTktjbHB0ZUhaa00wMTJaR3BKZFUxVE1XaGpibEp3V20xR2FtUkRNWGhrVjBaellWZGFjRmt5UmpCaFZ6bDFURzVzZEdKRlFua0tXbGRhZWt3eWFHeFpWMUo2VERKT2RscEhWalJNTTFsNVRHcEZkR0p1UW5STVdFSjVZak5hYkdKdFJuVlpNbFYwWTIxV2FtSXpXbXhqYm10M1QwRlpTd3BMZDFsQ1FrRkhSSFo2UVVKRmQxRnhSRU5vYkUxcVNtdE5WRUYzVFZSWmVrNVVXVEZOVkZrd1dsUkplRTVFYkcxUFZHeG9XV3BWTUZwRVJYaFpWRmw0Q2sxVVJUVk5la3BwVFVORlIwTnBjMGRCVVZGQ1p6YzRkMEZTVVVWRmQzZFNaREk1ZVdFeVduTmlNMlJtV2tkc2VtTkhSakJaTW1kM1dFRlpTMHQzV1VJS1FrRkhSSFo2UVVKR1VWSlBSRVY0YjJSSVVuZGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbGRYUm5WYU1uQXhZbTF3Y0ZwVE1VMWhWelIyVlRKT2FBcGliWGcxVERKR2FtUkhiSFppYmsxMlkyNVdkV041T0hwT1JHTXhUa1JaTTAxNlZUQk9lVGxvWkVoU2JHSllRakJqZVRoNFRVSlpSME5wYzBkQlVWRkNDbWMzT0hkQlVsbEZRMEYzUjJOSVZtbGlSMnhxVFVaM1IwTnBjMGRCVVZGQ1p6YzRkMEZTWjBWVVozaE5ZMjFXZDJKNmNGcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnBPVlJaTWtaMVlraHJObU50Vm0xUGJrcHNXbTVOZG1GSFZtaGFTRTEyV1RJNWExcFlaM1prYWtsMVRWTXhkV05ITUhSalNFcDJaRzFXZFFwWlZ6VnFXbE14ZVZwWFRuWmtiVlo1WlZSRFFtbDNXVXRMZDFsQ1FrRklWMlZSU1VWQloxSTVRa2h6UVdWUlFqTkJUakE1VFVkeVIzaDRSWGxaZUd0bENraEtiRzVPZDB0cFUydzJORE5xZVhRdk5HVkxZMjlCZGt0bE5rOUJRVUZDYjBweFMyd3dTVUZCUVZGRVFVVm5kMUpuU1doQlMwOHZNWGxYV25CelZYa0tWaTh3UWpoNWRVNW5VRkpWV25oTVV6SXZUbkJSUkVZM2VIUk1MMmxwTUZSQmFVVkJOa3N2Um10bFlreHNTMjFDVG1oRlFqRXhURXh0UW1WM1lqUjFjUXBJV1dVdmIwdEdVWEpZT0VsSGNtOTNRMmRaU1V0dldrbDZhakJGUVhkTlJHRlJRWGRhWjBsNFFWQjFUR1l4UkVSeVRYWnBhalJNT0RaYVRqZGtaMGRLQ2toaGFtMXdZbWN5YTFwNE9WSjFObUpZTlRNMmRHOW1aRFowYTFSeU4wbHVZWE0wTkc5MGJGZEJVVWw0UVV4T2EzQnBVVkppVHpKSGRsVkhaWE5FUVhNS1NtSXJOR1JDUXpaUVFtOU1kVGR6ZFV4NFowRlJTMmh6ZVhodVpEWkNXVEZsWmxwcU9GUTRWVEpMVlRJNVp6MDlDaTB0TFMwdFJVNUVJRU5GVWxSSlJrbERRVlJGTFMwdExTMEsifV19fQ==" + } + ], + "timestampVerificationData": {} + }, + "dsseEnvelope": { + "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoicGtnOm5wbS8lNDBzY2FubHkvbm9kZUAyLjEuMCIsImRpZ2VzdCI6eyJzaGE1MTIiOiI4OGY0MDRjMTU5ZDQwMGE0YTAzZWZmMDAyOTRhZDIwNzZkYzE3ZGJjODRiMjUzYzMzZmM4Yjc0MmI5NzViZWNjMzVkNjAyZTlmYTUyOWZmMGNhOTFkYzYzNTE0OGE4MDc4ZDU1NjQ4ODA5NzNhNjNjNDlhMmE3YzZkMWRjMzM3ZSJ9fV0sInByZWRpY2F0ZVR5cGUiOiJodHRwczovL3Nsc2EuZGV2L3Byb3ZlbmFuY2UvdjEiLCJwcmVkaWNhdGUiOnsiYnVpbGREZWZpbml0aW9uIjp7ImJ1aWxkVHlwZSI6Imh0dHBzOi8vc2xzYS1mcmFtZXdvcmsuZ2l0aHViLmlvL2dpdGh1Yi1hY3Rpb25zLWJ1aWxkdHlwZXMvd29ya2Zsb3cvdjEiLCJleHRlcm5hbFBhcmFtZXRlcnMiOnsid29ya2Zsb3ciOnsicmVmIjoicmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5IiwicmVwb3NpdG9yeSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkiLCJwYXRoIjoiLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbCJ9LCJzb3VyY2VfY29tbWl0IjoiNmIwMTdiNTNhNDQwNGY0ZmVhYjc3NmFjMTExYjBlYTlkYWNmMjczNCJ9LCJpbnRlcm5hbFBhcmFtZXRlcnMiOnsiZ2l0aHViIjp7ImV2ZW50X25hbWUiOiJ3b3JrZmxvd19kaXNwYXRjaCIsInJlcG9zaXRvcnlfaWQiOiIxMTU2MzQyNjUzIiwicmVwb3NpdG9yeV9vd25lcl9pZCI6IjIyNDM3MDg5OCJ9fSwicmVzb2x2ZWREZXBlbmRlbmNpZXMiOlt7InVyaSI6ImdpdCtodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5QHJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeSIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiJlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiIn19LHsidXJpIjoiZ2l0K2h0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHlANmIwMTdiNTNhNDQwNGY0ZmVhYjc3NmFjMTExYjBlYTlkYWNmMjczNCIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiI2YjAxN2I1M2E0NDA0ZjRmZWFiNzc2YWMxMTFiMGVhOWRhY2YyNzM0In19XX0sInJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY3Rpb25zL3J1bm5lci9naXRodWItaG9zdGVkIn0sIm1ldGFkYXRhIjp7Imludm9jYXRpb25JZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvYWN0aW9ucy9ydW5zLzM0NzU0NjczNTQ3L2F0dGVtcHRzLzEifX19fQ==", + "payloadType": "application/vnd.in-toto+json", + "signatures": [ + { + "sig": "MEUCIGWj3NGdabD7jzSiUjByuFsD0Oshue0v5Wv0q/6U/QpPAiEA5cPR2spT0MLoqZ4Vk3OA0QJJp9w3BYspfZZA/kGWLdg=" + } + ] + } +} diff --git a/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-parsers-2.1.0.tgz.sigstore.json b/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-parsers-2.1.0.tgz.sigstore.json new file mode 100644 index 0000000..077dfdb --- /dev/null +++ b/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-parsers-2.1.0.tgz.sigstore.json @@ -0,0 +1,60 @@ +{ + "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", + "verificationMaterial": { + "certificate": { + "rawBytes": "MIIIKzCCB7GgAwIBAgIUcXqJeRSgEHNxbyD1OZFTjhPA4igwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTEzMTEzMjQ5WhcNMjYwOTEzMTE0MjQ5WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEBic2EoTpD9H7/+esl5d+qnLIn/lmckm4yjbPedeNmzpBkMoZDM3XZyisFsuY8BjK9z2Fq6JvOkQ5+1kSmO8rx6OCBtAwggbMMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQU0O7cc+dXPuTDufAM6852eED2D/swHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wgZkGA1UdEQEB/wSBjjCBi4aBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAfBgorBgEEAYO/MAECBBF3b3JrZmxvd19kaXNwYXRjaDA2BgorBgEEAYO/MAEDBChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCkGCisGAQQBg78wAQQEG3YyLjEgQXJ0aWZhY3QgUXVhbGlmaWNhdGlvbjAjBgorBgEEAYO/MAEFBBVZYW5nanVuamllLUxpbi9TY2FubHkwOwYKKwYBBAGDvzABBgQtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTCBmgYKKwYBBAGDvzABCQSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABCgQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMB0GCisGAQQBg78wAQsEDwwNZ2l0aHViLWhvc3RlZDA4BgorBgEEAYO/MAEMBCoMKGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkwOAYKKwYBBAGDvzABDQQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMD0GCisGAQQBg78wAQ4ELwwtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MBoGCisGAQQBg78wAQ8EDAwKMTE1NjM0MjY1MzAxBgorBgEEAYO/MAEQBCMMIWh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbjAZBgorBgEEAYO/MAERBAsMCTIyNDM3MDg5ODCBmgYKKwYBBAGDvzABEgSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABEwQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCEGCisGAQQBg78wARQEEwwRd29ya2Zsb3dfZGlzcGF0Y2gwXAYKKwYBBAGDvzABFQRODExodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5L2FjdGlvbnMvcnVucy8zNDc1NDY3MzU0Ny9hdHRlbXB0cy8xMBYGCisGAQQBg78wARYECAwGcHVibGljMFwGCisGAQQBg78wARgETgxMcmVwbzpZYW5nanVuamllLUxpbi9TY2FubHk6cmVmOnJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeTCBiQYKKwYBBAHWeQIEAgR7BHkAdwB1AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABoJqKmrUAAAQDAEYwRAIgK/5BtHb4QEQ9WI62keDnhkT3wRgWl18xWPc+29PF+MUCICNvSUpmp4M1hgVhWuDFwWcIJxjjU6WDR7rQIppHJmuKMAoGCCqGSM49BAMDA2gAMGUCMEXfIXOvt23vcF0wvK32YBVVpHpUGF4qPabMOkBnzuxhyXfvrWTszA3xwjGDfEwZSgIxAK/A4wzxJzL7VL4C66ssVd5zdbTg9FjKAHVC83Bf74xo6Dg6dpOji/uUcIgMj/ntdQ==" + }, + "tlogEntries": [ + { + "logIndex": "2817433688", + "logId": { + "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=" + }, + "kindVersion": { + "kind": "dsse", + "version": "0.0.1" + }, + "integratedTime": "1789299170", + "inclusionPromise": { + "signedEntryTimestamp": "MEYCIQC6VgHJNyYh/Q938KJXrPTncg8wqTP1bNaRUKQbgb+QoAIhAOQV0bR5SRXDHCH8CR+vGn6Xwc9bi3GkTE6EWVp/UjKK" + }, + "inclusionProof": { + "logIndex": "2695529426", + "rootHash": "HeN6J9D2UX5WfQZ4Vg046nc3faL7IJ7IIiljf6iz4kk=", + "treeSize": "2695529432", + "hashes": [ + "nrfL/tSMHc0JWlISvmpJX+nvthd0ZIk6Bl/i2KZqGU8=", + "Q6IOzew5TFHqFNWCMD33qU/FnKU16k5mZEg6TxCxFVY=", + "hUdzzFhUH080xeYsGph+Q30GR67t4YaKf8tpDuVxfIQ=", + "dBpn4HSGE1rShP21L4UsqKWfKCWcCaSwCVF2R9rtHXM=", + "pWy7d5ZefMWAzclbUK3K3t2dW+MagxSobimwzJY6Fcc=", + "rrJ+IT6Ox7bGvTZMhVYGUysc0kgPwEDx+bWNiC2B29k=", + "ehRgb+TFDrmRrXHfwZdtb/xHcytPVqjwJrGxtpYgXY8=", + "JB/RNmp6kfQ4AFK/yjP1W28cn5xu4p4PvAGOfnm1q5c=", + "99PoJTYgPWevn9oVlADbWdRGR90JL8Fx/FV0T06o0IA=", + "LQtwekqXPoO3KgXYEfRsV0WYK6Gk0PLLePxJWdZgThQ=", + "qOZd1StyLttRdZ9ojwet4/yO1QqFuSN2bQKQaTXLrkY=", + "uXYCZMF7lS28YUWZqw7VfMV5vdtFS6j7/bavDJtBebk=", + "S39m2eTD1rqRuAMs4r+sGsYIwW0BlTWuysWTKJ8RKVk=", + "qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=", + "xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY=" + ], + "checkpoint": { + "envelope": "rekor.sigstore.dev - 1193050959916656506\n2695529432\nHeN6J9D2UX5WfQZ4Vg046nc3faL7IJ7IIiljf6iz4kk=\n\n— rekor.sigstore.dev wNI9ajBEAiAl5lq5gf/OUISt9qIdteOshwpmmeP3pnLDc5oBjNQ7xAIgeLc0NIF3pjM62o889m3Hy48tVlUlNgdxBo6u/ernoBY=\n" + } + }, + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiYmE4MjJjNTA3Y2U4NGQzYWI0NzJkZWRkMzM5NDNlYjI1NjMwYThmYTQyODg0MzFkMTM0ZjFkNmIyNzU1MTJlMSJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImExOGI3NTcwMmViY2I2ODU5NzVhNzhiMWRiYzdkNTZiNjYxM2M4ODlkZTc1MTFlNzExNGQyNmUyZjI3NmUxZmYifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVRQ0lEb3graTNrUis2TDJzaXd2Wk9rdDFhSTRQMGJ0ejB4YkpiY2pXcHhKZzNJQWlBSGhSYlBLemtoUzFUNFdGS0w1OHdDb3l5RCt1NGtPc09PazZTZjk0Ry9yQT09IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VsTGVrTkRRamRIWjBGM1NVSkJaMGxWWTFoeFNtVlNVMmRGU0U1NFlubEVNVTlhUmxScWFGQkJOR2xuZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwOVVSWHBOVkVWNlRXcFJOVmRvWTA1TmFsbDNUMVJGZWsxVVJUQk5hbEUxVjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVkNhV015Ulc5VWNFUTVTRGN2SzJWemJEVmtLM0Z1VEVsdUwyeHRZMnR0TkhscVlsQUtaV1JsVG0xNmNFSnJUVzlhUkUweldGcDVhWE5HYzNWWk9FSnFTemw2TWtaeE5rcDJUMnRSTlNzeGExTnRUemh5ZURaUFEwSjBRWGRuWjJKTlRVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVXdUemRqQ21NclpGaFFkVlJFZFdaQlRUWTROVEpsUlVReVJDOXpkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMmRhYTBkQk1WVmtSVkZGUWk5M1UwSnFha05DYVRSaFFtbEhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RRcGhiV3hzVEZWNGNHSnBPVlJaTWtaMVlraHJka3h0WkhCa1IyZ3hXV2s1TTJJelNuSmFiWGgyWkROTmRtUnFTWFZOVXpGb1kyNVNjRnB0Um1wa1F6RjRDbVJYUm5OaFYxcHdXVEpHTUdGWE9YVk1ibXgwWWtWQ2VWcFhXbnBNTW1oc1dWZFNla3d5VG5aYVIxWTBURE5aZVV4cVJYUmlia0owVEZoQ2VXSXpXbXdLWW0xR2RWa3lWWFJqYlZacVlqTmFiR051YTNkUFVWbExTM2RaUWtKQlIwUjJla0ZDUVZGUmNtRklVakJqU0UwMlRIazVNR0l5ZEd4aWFUVm9XVE5TY0FwaU1qVjZURzFrY0dSSGFERlpibFo2V2xoS2FtSXlOVEJhVnpVd1RHMU9kbUpVUVdaQ1oyOXlRbWRGUlVGWlR5OU5RVVZEUWtKR00ySXpTbkphYlhoMkNtUXhPV3RoV0U1M1dWaFNhbUZFUVRKQ1oyOXlRbWRGUlVGWlR5OU5RVVZFUWtOb2JFMXFTbXROVkVGM1RWUlplazVVV1RGTlZGa3dXbFJKZUU1RWJHMEtUMVJzYUZscVZUQmFSRVY0V1ZSWmVFMVVSVFZOZWtwcFRVTnJSME5wYzBkQlVWRkNaemM0ZDBGUlVVVkhNMWw1VEdwRloxRllTakJoVjFwb1dUTlJad3BWV0Zab1lrZHNiV0ZYVG1oa1IyeDJZbXBCYWtKbmIzSkNaMFZGUVZsUEwwMUJSVVpDUWxaYVdWYzFibUZ1Vm5WaGJXeHNURlY0Y0dKcE9WUlpNa1oxQ21KSWEzZFBkMWxMUzNkWlFrSkJSMFIyZWtGQ1FtZFJkR050Vm0xamVUbHZXbGRHYTJONU9XcGlNbEpzWlVNNU1rMXBOSGhNVnpWM1lsTXhkMk50T1RJS1dsYzFhR0p0VG14TVdFcHNXVEk1TWxwWVNqVk5SSE5IUTJselIwRlJVVUpuTnpoM1FWRm5SVXhSZDNKaFNGSXdZMGhOTmt4NU9UQmlNblJzWW1rMWFBcFpNMUp3WWpJMWVreHRaSEJrUjJneFdXNVdlbHBZU21waU1qVXdXbGMxTUV4dFRuWmlWRU5DYldkWlMwdDNXVUpDUVVkRWRucEJRa05SVTBKcGQzbENDbWxIYURCa1NFSjZUMms0ZGxveWJEQmhTRlpwVEcxT2RtSlRPVnBaVnpWdVlXNVdkV0Z0Ykd4TVZYaHdZbWs1VkZreVJuVmlTR3QyVEcxa2NHUkhhREVLV1drNU0ySXpTbkphYlhoMlpETk5kbVJxU1hWTlV6Rm9ZMjVTY0ZwdFJtcGtRekY0WkZkR2MyRlhXbkJaTWtZd1lWYzVkVXh1YkhSaVJVSjVXbGRhZWdwTU1taHNXVmRTZWt3eVRuWmFSMVkwVEROWmVVeHFSWFJpYmtKMFRGaENlV0l6V214aWJVWjFXVEpWZEdOdFZtcGlNMXBzWTI1cmQwOUJXVXRMZDFsQ0NrSkJSMFIyZWtGQ1EyZFJjVVJEYUd4TmFrcHJUVlJCZDAxVVdYcE9WRmt4VFZSWk1GcFVTWGhPUkd4dFQxUnNhRmxxVlRCYVJFVjRXVlJaZUUxVVJUVUtUWHBLYVUxQ01FZERhWE5IUVZGUlFtYzNPSGRCVVhORlJIZDNUbG95YkRCaFNGWnBURmRvZG1NelVteGFSRUUwUW1kdmNrSm5SVVZCV1U4dlRVRkZUUXBDUTI5TlMwZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNVdsbFhOVzVoYmxaMVlXMXNiRXhWZUhCaWFUbFVXVEpHZFdKSWEzZFBRVmxMQ2t0M1dVSkNRVWRFZG5wQlFrUlJVWEZFUTJoc1RXcEthMDFVUVhkTlZGbDZUbFJaTVUxVVdUQmFWRWw0VGtSc2JVOVViR2haYWxVd1drUkZlRmxVV1hnS1RWUkZOVTE2U21sTlJEQkhRMmx6UjBGUlVVSm5OemgzUVZFMFJVeDNkM1JqYlZadFkzazViMXBYUm10amVUbHFZakpTYkdWRE9USk5hVFI0VEZjMWR3cGlVekYzWTIwNU1scFhOV2hpYlU1c1RGaEtiRmt5T1RKYVdFbzFUVUp2UjBOcGMwZEJVVkZDWnpjNGQwRlJPRVZFUVhkTFRWUkZNVTVxVFRCTmFsa3hDazE2UVhoQ1oyOXlRbWRGUlVGWlR5OU5RVVZSUWtOTlRVbFhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnFRVnBDWjI5eVFtZEZSVUZaVHk5TlFVVlNRa0Z6VFVOVVNYbE9SRTB6VFVSbk5VOUVRMEp0WjFsTFMzZFpRa0pCUjBSMmVrRkNSV2RUUWdwcGQzbENhVWRvTUdSSVFucFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVXbGxYTlc1aGJsWjFZVzFzYkV4VmVIQmlhVGxVV1RKR2RXSklhM1pNYldSd0NtUkhhREZaYVRrellqTktjbHB0ZUhaa00wMTJaR3BKZFUxVE1XaGpibEp3V20xR2FtUkRNWGhrVjBaellWZGFjRmt5UmpCaFZ6bDFURzVzZEdKRlFua0tXbGRhZWt3eWFHeFpWMUo2VERKT2RscEhWalJNTTFsNVRHcEZkR0p1UW5STVdFSjVZak5hYkdKdFJuVlpNbFYwWTIxV2FtSXpXbXhqYm10M1QwRlpTd3BMZDFsQ1FrRkhSSFo2UVVKRmQxRnhSRU5vYkUxcVNtdE5WRUYzVFZSWmVrNVVXVEZOVkZrd1dsUkplRTVFYkcxUFZHeG9XV3BWTUZwRVJYaFpWRmw0Q2sxVVJUVk5la3BwVFVORlIwTnBjMGRCVVZGQ1p6YzRkMEZTVVVWRmQzZFNaREk1ZVdFeVduTmlNMlJtV2tkc2VtTkhSakJaTW1kM1dFRlpTMHQzV1VJS1FrRkhSSFo2UVVKR1VWSlBSRVY0YjJSSVVuZGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbGRYUm5WYU1uQXhZbTF3Y0ZwVE1VMWhWelIyVlRKT2FBcGliWGcxVERKR2FtUkhiSFppYmsxMlkyNVdkV041T0hwT1JHTXhUa1JaTTAxNlZUQk9lVGxvWkVoU2JHSllRakJqZVRoNFRVSlpSME5wYzBkQlVWRkNDbWMzT0hkQlVsbEZRMEYzUjJOSVZtbGlSMnhxVFVaM1IwTnBjMGRCVVZGQ1p6YzRkMEZTWjBWVVozaE5ZMjFXZDJKNmNGcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnBPVlJaTWtaMVlraHJObU50Vm0xUGJrcHNXbTVOZG1GSFZtaGFTRTEyV1RJNWExcFlaM1prYWtsMVRWTXhkV05ITUhSalNFcDJaRzFXZFFwWlZ6VnFXbE14ZVZwWFRuWmtiVlo1WlZSRFFtbFJXVXRMZDFsQ1FrRklWMlZSU1VWQloxSTNRa2hyUVdSM1FqRkJUakE1VFVkeVIzaDRSWGxaZUd0bENraEtiRzVPZDB0cFUydzJORE5xZVhRdk5HVkxZMjlCZGt0bE5rOUJRVUZDYjBweFMyMXlWVUZCUVZGRVFVVlpkMUpCU1dkTEx6VkNkRWhpTkZGRlVUa0tWMGsyTW10bFJHNW9hMVF6ZDFKblYyd3hPSGhYVUdNck1qbFFSaXROVlVOSlEwNTJVMVZ3YlhBMFRURm9aMVpvVjNWRVJuZFhZMGxLZUdwcVZUWlhSQXBTTjNKUlNYQndTRXB0ZFV0TlFXOUhRME54UjFOTk5EbENRVTFFUVRKblFVMUhWVU5OUlZobVNWaFBkblF5TTNaalJqQjNka3N6TWxsQ1ZsWndTSEJWQ2tkR05IRlFZV0pOVDJ0Q2JucDFlR2g1V0daMmNsZFVjM3BCTTNoM2FrZEVaa1YzV2xOblNYaEJTeTlCTkhkNmVFcDZURGRXVERSRE5qWnpjMVprTlhvS1pHSlVaemxHYWt0QlNGWkRPRE5DWmpjMGVHODJSR2MyWkhCUGFta3ZkVlZqU1dkTmFpOXVkR1JSUFQwS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9XX19" + } + ], + "timestampVerificationData": {} + }, + "dsseEnvelope": { + "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoicGtnOm5wbS8lNDBzY2FubHkvcGFyc2Vyc0AyLjEuMCIsImRpZ2VzdCI6eyJzaGE1MTIiOiIxYWE2ODMzNDA3ZTlkMjZhZDAyYjE2MGYyNTM3OTZlNzNkOTUxN2M1YzlhYTVkNmQ2NDc5NWZjY2MzNzU5MWY0ZDE5OTdmNDQzZmY1YmEzNGYwYzA1ZmVhMzVjOWJiMjE3YjIzOTE2ZjRiMjQxOGVmMDRmMDk5YTg4YjU5NDc1NSJ9fV0sInByZWRpY2F0ZVR5cGUiOiJodHRwczovL3Nsc2EuZGV2L3Byb3ZlbmFuY2UvdjEiLCJwcmVkaWNhdGUiOnsiYnVpbGREZWZpbml0aW9uIjp7ImJ1aWxkVHlwZSI6Imh0dHBzOi8vc2xzYS1mcmFtZXdvcmsuZ2l0aHViLmlvL2dpdGh1Yi1hY3Rpb25zLWJ1aWxkdHlwZXMvd29ya2Zsb3cvdjEiLCJleHRlcm5hbFBhcmFtZXRlcnMiOnsid29ya2Zsb3ciOnsicmVmIjoicmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5IiwicmVwb3NpdG9yeSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkiLCJwYXRoIjoiLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbCJ9LCJzb3VyY2VfY29tbWl0IjoiNmIwMTdiNTNhNDQwNGY0ZmVhYjc3NmFjMTExYjBlYTlkYWNmMjczNCJ9LCJpbnRlcm5hbFBhcmFtZXRlcnMiOnsiZ2l0aHViIjp7ImV2ZW50X25hbWUiOiJ3b3JrZmxvd19kaXNwYXRjaCIsInJlcG9zaXRvcnlfaWQiOiIxMTU2MzQyNjUzIiwicmVwb3NpdG9yeV9vd25lcl9pZCI6IjIyNDM3MDg5OCJ9fSwicmVzb2x2ZWREZXBlbmRlbmNpZXMiOlt7InVyaSI6ImdpdCtodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5QHJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeSIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiJlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiIn19LHsidXJpIjoiZ2l0K2h0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHlANmIwMTdiNTNhNDQwNGY0ZmVhYjc3NmFjMTExYjBlYTlkYWNmMjczNCIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiI2YjAxN2I1M2E0NDA0ZjRmZWFiNzc2YWMxMTFiMGVhOWRhY2YyNzM0In19XX0sInJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY3Rpb25zL3J1bm5lci9naXRodWItaG9zdGVkIn0sIm1ldGFkYXRhIjp7Imludm9jYXRpb25JZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvYWN0aW9ucy9ydW5zLzM0NzU0NjczNTQ3L2F0dGVtcHRzLzEifX19fQ==", + "payloadType": "application/vnd.in-toto+json", + "signatures": [ + { + "sig": "MEQCIDox+i3kR+6L2siwvZOkt1aI4P0btz0xbJbcjWpxJg3IAiAHhRbPKzkhS1T4WFKL58wCoyyD+u4kOsOOk6Sf94G/rA==" + } + ] + } +} diff --git a/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-react-2.1.0.tgz.sigstore.json b/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-react-2.1.0.tgz.sigstore.json new file mode 100644 index 0000000..7fa785e --- /dev/null +++ b/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-react-2.1.0.tgz.sigstore.json @@ -0,0 +1,59 @@ +{ + "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", + "verificationMaterial": { + "certificate": { + "rawBytes": "MIIILDCCB7GgAwIBAgIUZVTYnNWzMCxED30+D7jJIVPbV9UwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTEzMTEzMjUwWhcNMjYwOTEzMTE0MjUwWjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE3boffsQ/QpEnIHP5RahwzUwkLxW1W5Ntf2bpeGMoCy48/jvJPg2w2sf36VvuxBYrW+6Vq8dUCyfWTEAAFNNbs6OCBtAwggbMMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUyWxn5BSMLils6ZgfYjOJ6JYBmskwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wgZkGA1UdEQEB/wSBjjCBi4aBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAfBgorBgEEAYO/MAECBBF3b3JrZmxvd19kaXNwYXRjaDA2BgorBgEEAYO/MAEDBChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCkGCisGAQQBg78wAQQEG3YyLjEgQXJ0aWZhY3QgUXVhbGlmaWNhdGlvbjAjBgorBgEEAYO/MAEFBBVZYW5nanVuamllLUxpbi9TY2FubHkwOwYKKwYBBAGDvzABBgQtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTCBmgYKKwYBBAGDvzABCQSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABCgQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMB0GCisGAQQBg78wAQsEDwwNZ2l0aHViLWhvc3RlZDA4BgorBgEEAYO/MAEMBCoMKGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkwOAYKKwYBBAGDvzABDQQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMD0GCisGAQQBg78wAQ4ELwwtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MBoGCisGAQQBg78wAQ8EDAwKMTE1NjM0MjY1MzAxBgorBgEEAYO/MAEQBCMMIWh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbjAZBgorBgEEAYO/MAERBAsMCTIyNDM3MDg5ODCBmgYKKwYBBAGDvzABEgSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABEwQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCEGCisGAQQBg78wARQEEwwRd29ya2Zsb3dfZGlzcGF0Y2gwXAYKKwYBBAGDvzABFQRODExodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5L2FjdGlvbnMvcnVucy8zNDc1NDY3MzU0Ny9hdHRlbXB0cy8xMBYGCisGAQQBg78wARYECAwGcHVibGljMFwGCisGAQQBg78wARgETgxMcmVwbzpZYW5nanVuamllLUxpbi9TY2FubHk6cmVmOnJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeTCBiQYKKwYBBAHWeQIEAgR7BHkAdwB1AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABoJqKnjkAAAQDAEYwRAIgREJtDFMyVOFg8wxxd0eKb5kiai7wrZ8H2I2T4uVuNikCIHxkhT/VMc9byylXGuiRWTWBD2gQMVBMg0CGjBeaD+A5MAoGCCqGSM49BAMDA2kAMGYCMQCDQMCn/7eLkn8YrX1csVfGHD4Lcq01rg7JsopGENXUWbulyG32oAOJz+Ugo7sFLHkCMQCBJ7JDyhFmWJbM6iwTjh4tCf+rGAPonW89OhfxSEiuExhMpt0fCHI9OCIDs/JOmKo=" + }, + "tlogEntries": [ + { + "logIndex": "2817433777", + "logId": { + "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=" + }, + "kindVersion": { + "kind": "dsse", + "version": "0.0.1" + }, + "integratedTime": "1789299171", + "inclusionPromise": { + "signedEntryTimestamp": "MEYCIQDpXvm2FMA9XDIfbL7RXmvooKdpJi7FIIFpQrfWSahh3gIhAPMIRDAZpCRncl+KRINyTDW0+zYpuXvl0r1K+A994rC5" + }, + "inclusionProof": { + "logIndex": "2695529515", + "rootHash": "qjhJ7/tIh9D+DSpuZ9l3uo3yqF+RzSo0k7JFb7ID0jA=", + "treeSize": "2695529525", + "hashes": [ + "cWVX3h+Ls+NxgBgjQJ65qwb9zkG+WVn/OlNLGViBWf4=", + "69kSzR2RThd1Ygocnc1MawlTX3ZXlTMEof1ySJP1VRA=", + "RXDAusmA7ecj+N2u6E8cD4WJM+Ca1TnhpylP2M3ETxc=", + "0tKnVkleIwXJpQc8RuGtA7yOSw1QJNeo56kPh2XCsOs=", + "zIktXkKbnBnwB3/S7bd9lYL6RhMFdFtwEn0CvUFSdVo=", + "nAyOaHb6YhgMUfXlHpleWSgMOUs+byCrTziqoqUzzGc=", + "ys1AmRgOQ1cBbTrHqVAy0aCMdqJ6C/QxHXAD9GZhxmA=", + "99PoJTYgPWevn9oVlADbWdRGR90JL8Fx/FV0T06o0IA=", + "LQtwekqXPoO3KgXYEfRsV0WYK6Gk0PLLePxJWdZgThQ=", + "qOZd1StyLttRdZ9ojwet4/yO1QqFuSN2bQKQaTXLrkY=", + "uXYCZMF7lS28YUWZqw7VfMV5vdtFS6j7/bavDJtBebk=", + "S39m2eTD1rqRuAMs4r+sGsYIwW0BlTWuysWTKJ8RKVk=", + "qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=", + "xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY=" + ], + "checkpoint": { + "envelope": "rekor.sigstore.dev - 1193050959916656506\n2695529525\nqjhJ7/tIh9D+DSpuZ9l3uo3yqF+RzSo0k7JFb7ID0jA=\n\n— rekor.sigstore.dev wNI9ajBEAiBMEZyPNRPWXQ7CIQjjTleqQAChuLNxgqBw21zXiGxyIgIgJ8QCiwPbv/IN6QDbH55q2keIZrYtKHkgdiNB08o60d0=\n" + } + }, + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiZWZiNjYzNzIwODY1YTc3ZTMwODM4ZTI5MzI1ZmE2NTUzMDc3ZDExOTNjNDk0MjhjNTIzZDJkN2FmZjAwZDBmMyJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjA0OGYzZjlmYjRkNGFlYjczMzY0NTNlZWZiMjY2ZDc4ZmUyYWQxNjUyYjE4MjUzNjFlOTYzMjI3OTMwZTdhNWMifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVZQ0lRQ1pUNGVhbWxGU1hLdUhxSUhNYWdjdHAwMk5OdDdhTXM4d2E0THFyOTQ3MFFJaEFPOVBzM29FVitTRzh1ektwMENiTmhlRWJKNUlIc2ZrS3pPd0tEWDFNM0Z3IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VsTVJFTkRRamRIWjBGM1NVSkJaMGxWV2xaVVdXNU9WM3BOUTNoRlJETXdLMFEzYWtwSlZsQmlWamxWZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwOVVSWHBOVkVWNlRXcFZkMWRvWTA1TmFsbDNUMVJGZWsxVVJUQk5hbFYzVjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVXpZbTltWm5OUkwxRndSVzVKU0ZBMVVtRm9kM3BWZDJ0TWVGY3hWelZPZEdZeVluQUtaVWROYjBONU5EZ3ZhblpLVUdjeWR6Snpaak0yVm5aMWVFSlpjbGNyTmxaeE9HUlZRM2xtVjFSRlFVRkdUazVpY3paUFEwSjBRWGRuWjJKTlRVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVjVWM2h1Q2pWQ1UwMU1hV3h6TmxwblpsbHFUMG8yU2xsQ2JYTnJkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMmRhYTBkQk1WVmtSVkZGUWk5M1UwSnFha05DYVRSaFFtbEhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RRcGhiV3hzVEZWNGNHSnBPVlJaTWtaMVlraHJka3h0WkhCa1IyZ3hXV2s1TTJJelNuSmFiWGgyWkROTmRtUnFTWFZOVXpGb1kyNVNjRnB0Um1wa1F6RjRDbVJYUm5OaFYxcHdXVEpHTUdGWE9YVk1ibXgwWWtWQ2VWcFhXbnBNTW1oc1dWZFNla3d5VG5aYVIxWTBURE5aZVV4cVJYUmlia0owVEZoQ2VXSXpXbXdLWW0xR2RWa3lWWFJqYlZacVlqTmFiR051YTNkUFVWbExTM2RaUWtKQlIwUjJla0ZDUVZGUmNtRklVakJqU0UwMlRIazVNR0l5ZEd4aWFUVm9XVE5TY0FwaU1qVjZURzFrY0dSSGFERlpibFo2V2xoS2FtSXlOVEJhVnpVd1RHMU9kbUpVUVdaQ1oyOXlRbWRGUlVGWlR5OU5RVVZEUWtKR00ySXpTbkphYlhoMkNtUXhPV3RoV0U1M1dWaFNhbUZFUVRKQ1oyOXlRbWRGUlVGWlR5OU5RVVZFUWtOb2JFMXFTbXROVkVGM1RWUlplazVVV1RGTlZGa3dXbFJKZUU1RWJHMEtUMVJzYUZscVZUQmFSRVY0V1ZSWmVFMVVSVFZOZWtwcFRVTnJSME5wYzBkQlVWRkNaemM0ZDBGUlVVVkhNMWw1VEdwRloxRllTakJoVjFwb1dUTlJad3BWV0Zab1lrZHNiV0ZYVG1oa1IyeDJZbXBCYWtKbmIzSkNaMFZGUVZsUEwwMUJSVVpDUWxaYVdWYzFibUZ1Vm5WaGJXeHNURlY0Y0dKcE9WUlpNa1oxQ21KSWEzZFBkMWxMUzNkWlFrSkJSMFIyZWtGQ1FtZFJkR050Vm0xamVUbHZXbGRHYTJONU9XcGlNbEpzWlVNNU1rMXBOSGhNVnpWM1lsTXhkMk50T1RJS1dsYzFhR0p0VG14TVdFcHNXVEk1TWxwWVNqVk5SSE5IUTJselIwRlJVVUpuTnpoM1FWRm5SVXhSZDNKaFNGSXdZMGhOTmt4NU9UQmlNblJzWW1rMWFBcFpNMUp3WWpJMWVreHRaSEJrUjJneFdXNVdlbHBZU21waU1qVXdXbGMxTUV4dFRuWmlWRU5DYldkWlMwdDNXVUpDUVVkRWRucEJRa05SVTBKcGQzbENDbWxIYURCa1NFSjZUMms0ZGxveWJEQmhTRlpwVEcxT2RtSlRPVnBaVnpWdVlXNVdkV0Z0Ykd4TVZYaHdZbWs1VkZreVJuVmlTR3QyVEcxa2NHUkhhREVLV1drNU0ySXpTbkphYlhoMlpETk5kbVJxU1hWTlV6Rm9ZMjVTY0ZwdFJtcGtRekY0WkZkR2MyRlhXbkJaTWtZd1lWYzVkVXh1YkhSaVJVSjVXbGRhZWdwTU1taHNXVmRTZWt3eVRuWmFSMVkwVEROWmVVeHFSWFJpYmtKMFRGaENlV0l6V214aWJVWjFXVEpWZEdOdFZtcGlNMXBzWTI1cmQwOUJXVXRMZDFsQ0NrSkJSMFIyZWtGQ1EyZFJjVVJEYUd4TmFrcHJUVlJCZDAxVVdYcE9WRmt4VFZSWk1GcFVTWGhPUkd4dFQxUnNhRmxxVlRCYVJFVjRXVlJaZUUxVVJUVUtUWHBLYVUxQ01FZERhWE5IUVZGUlFtYzNPSGRCVVhORlJIZDNUbG95YkRCaFNGWnBURmRvZG1NelVteGFSRUUwUW1kdmNrSm5SVVZCV1U4dlRVRkZUUXBDUTI5TlMwZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNVdsbFhOVzVoYmxaMVlXMXNiRXhWZUhCaWFUbFVXVEpHZFdKSWEzZFBRVmxMQ2t0M1dVSkNRVWRFZG5wQlFrUlJVWEZFUTJoc1RXcEthMDFVUVhkTlZGbDZUbFJaTVUxVVdUQmFWRWw0VGtSc2JVOVViR2haYWxVd1drUkZlRmxVV1hnS1RWUkZOVTE2U21sTlJEQkhRMmx6UjBGUlVVSm5OemgzUVZFMFJVeDNkM1JqYlZadFkzazViMXBYUm10amVUbHFZakpTYkdWRE9USk5hVFI0VEZjMWR3cGlVekYzWTIwNU1scFhOV2hpYlU1c1RGaEtiRmt5T1RKYVdFbzFUVUp2UjBOcGMwZEJVVkZDWnpjNGQwRlJPRVZFUVhkTFRWUkZNVTVxVFRCTmFsa3hDazE2UVhoQ1oyOXlRbWRGUlVGWlR5OU5RVVZSUWtOTlRVbFhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnFRVnBDWjI5eVFtZEZSVUZaVHk5TlFVVlNRa0Z6VFVOVVNYbE9SRTB6VFVSbk5VOUVRMEp0WjFsTFMzZFpRa0pCUjBSMmVrRkNSV2RUUWdwcGQzbENhVWRvTUdSSVFucFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVXbGxYTlc1aGJsWjFZVzFzYkV4VmVIQmlhVGxVV1RKR2RXSklhM1pNYldSd0NtUkhhREZaYVRrellqTktjbHB0ZUhaa00wMTJaR3BKZFUxVE1XaGpibEp3V20xR2FtUkRNWGhrVjBaellWZGFjRmt5UmpCaFZ6bDFURzVzZEdKRlFua0tXbGRhZWt3eWFHeFpWMUo2VERKT2RscEhWalJNTTFsNVRHcEZkR0p1UW5STVdFSjVZak5hYkdKdFJuVlpNbFYwWTIxV2FtSXpXbXhqYm10M1QwRlpTd3BMZDFsQ1FrRkhSSFo2UVVKRmQxRnhSRU5vYkUxcVNtdE5WRUYzVFZSWmVrNVVXVEZOVkZrd1dsUkplRTVFYkcxUFZHeG9XV3BWTUZwRVJYaFpWRmw0Q2sxVVJUVk5la3BwVFVORlIwTnBjMGRCVVZGQ1p6YzRkMEZTVVVWRmQzZFNaREk1ZVdFeVduTmlNMlJtV2tkc2VtTkhSakJaTW1kM1dFRlpTMHQzV1VJS1FrRkhSSFo2UVVKR1VWSlBSRVY0YjJSSVVuZGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbGRYUm5WYU1uQXhZbTF3Y0ZwVE1VMWhWelIyVlRKT2FBcGliWGcxVERKR2FtUkhiSFppYmsxMlkyNVdkV041T0hwT1JHTXhUa1JaTTAxNlZUQk9lVGxvWkVoU2JHSllRakJqZVRoNFRVSlpSME5wYzBkQlVWRkNDbWMzT0hkQlVsbEZRMEYzUjJOSVZtbGlSMnhxVFVaM1IwTnBjMGRCVVZGQ1p6YzRkMEZTWjBWVVozaE5ZMjFXZDJKNmNGcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnBPVlJaTWtaMVlraHJObU50Vm0xUGJrcHNXbTVOZG1GSFZtaGFTRTEyV1RJNWExcFlaM1prYWtsMVRWTXhkV05ITUhSalNFcDJaRzFXZFFwWlZ6VnFXbE14ZVZwWFRuWmtiVlo1WlZSRFFtbFJXVXRMZDFsQ1FrRklWMlZSU1VWQloxSTNRa2hyUVdSM1FqRkJUakE1VFVkeVIzaDRSWGxaZUd0bENraEtiRzVPZDB0cFUydzJORE5xZVhRdk5HVkxZMjlCZGt0bE5rOUJRVUZDYjBweFMyNXFhMEZCUVZGRVFVVlpkMUpCU1dkU1JVcDBSRVpOZVZaUFJtY0tPSGQ0ZUdRd1pVdGlOV3RwWVdrM2QzSmFPRWd5U1RKVU5IVldkVTVwYTBOSlNIaHJhRlF2Vmsxak9XSjVlV3hZUjNWcFVsZFVWMEpFTW1kUlRWWkNUUXBuTUVOSGFrSmxZVVFyUVRWTlFXOUhRME54UjFOTk5EbENRVTFFUVRKclFVMUhXVU5OVVVORVVVMURiaTgzWlV4cmJqaFpjbGd4WTNOV1prZElSRFJNQ21OeE1ERnlaemRLYzI5d1IwVk9XRlZYWW5Wc2VVY3pNbTlCVDBwNksxVm5iemR6Umt4SWEwTk5VVU5DU2pkS1JIbG9SbTFYU21KTk5tbDNWR3BvTkhRS1EyWXJja2RCVUc5dVZ6ZzVUMmhtZUZORmFYVkZlR2hOY0hRd1prTklTVGxQUTBsRWN5OUtUMjFMYnowS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9XX19" + } + ], + "timestampVerificationData": {} + }, + "dsseEnvelope": { + "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoicGtnOm5wbS8lNDBzY2FubHkvcmVhY3RAMi4xLjAiLCJkaWdlc3QiOnsic2hhNTEyIjoiOGMyYjhlZTkwOGFhMDk3Y2U3YzEzMmE0ZmJkMzY3MWUxMjY0NjY1ZWQ0Y2QzNGE3ZGUzY2M1MjE4OGU4MDBhY2JkMmRkOGQyNTVjZGIxMGY3ODZiNjg2MzgzMTBkODMwMWExMWZiNmM4YzcxYjdlMDgwYmRhODg3NDFmMGE0OTcifX1dLCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9zbHNhLmRldi9wcm92ZW5hbmNlL3YxIiwicHJlZGljYXRlIjp7ImJ1aWxkRGVmaW5pdGlvbiI6eyJidWlsZFR5cGUiOiJodHRwczovL3Nsc2EtZnJhbWV3b3JrLmdpdGh1Yi5pby9naXRodWItYWN0aW9ucy1idWlsZHR5cGVzL3dvcmtmbG93L3YxIiwiZXh0ZXJuYWxQYXJhbWV0ZXJzIjp7IndvcmtmbG93Ijp7InJlZiI6InJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeSIsInJlcG9zaXRvcnkiOiJodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5IiwicGF0aCI6Ii5naXRodWIvd29ya2Zsb3dzL3YyLjEtYXJ0aWZhY3QtcXVhbGlmaWNhdGlvbi55bWwifSwic291cmNlX2NvbW1pdCI6IjZiMDE3YjUzYTQ0MDRmNGZlYWI3NzZhYzExMWIwZWE5ZGFjZjI3MzQifSwiaW50ZXJuYWxQYXJhbWV0ZXJzIjp7ImdpdGh1YiI6eyJldmVudF9uYW1lIjoid29ya2Zsb3dfZGlzcGF0Y2giLCJyZXBvc2l0b3J5X2lkIjoiMTE1NjM0MjY1MyIsInJlcG9zaXRvcnlfb3duZXJfaWQiOiIyMjQzNzA4OTgifX0sInJlc29sdmVkRGVwZW5kZW5jaWVzIjpbeyJ1cmkiOiJnaXQraHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seUByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkiLCJkaWdlc3QiOnsiZ2l0Q29tbWl0IjoiZTIyZDEwMDE2MzU2NTE2NGUyMTQ5Zjk5YWI1NGQxMWE2MTExOTMyYiJ9fSx7InVyaSI6ImdpdCtodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5QDZiMDE3YjUzYTQ0MDRmNGZlYWI3NzZhYzExMWIwZWE5ZGFjZjI3MzQiLCJkaWdlc3QiOnsiZ2l0Q29tbWl0IjoiNmIwMTdiNTNhNDQwNGY0ZmVhYjc3NmFjMTExYjBlYTlkYWNmMjczNCJ9fV19LCJydW5EZXRhaWxzIjp7ImJ1aWxkZXIiOnsiaWQiOiJodHRwczovL2dpdGh1Yi5jb20vYWN0aW9ucy9ydW5uZXIvZ2l0aHViLWhvc3RlZCJ9LCJtZXRhZGF0YSI6eyJpbnZvY2F0aW9uSWQiOiJodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5L2FjdGlvbnMvcnVucy8zNDc1NDY3MzU0Ny9hdHRlbXB0cy8xIn19fX0=", + "payloadType": "application/vnd.in-toto+json", + "signatures": [ + { + "sig": "MEYCIQCZT4eamlFSXKuHqIHMagctp02NNt7aMs8wa4Lqr9470QIhAO9Ps3oEV+SG8uzKp0CbNheEbJ5IHsfkKzOwKDX1M3Fw" + } + ] + } +} diff --git a/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-scenario-schema-2.1.0.tgz.sigstore.json b/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-scenario-schema-2.1.0.tgz.sigstore.json new file mode 100644 index 0000000..30bb099 --- /dev/null +++ b/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-scenario-schema-2.1.0.tgz.sigstore.json @@ -0,0 +1,61 @@ +{ + "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", + "verificationMaterial": { + "certificate": { + "rawBytes": "MIIIKzCCB7KgAwIBAgIUabycPtDdkFVYTriwd84bpOM7txcwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTEzMTEzMjUxWhcNMjYwOTEzMTE0MjUxWjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEnQdWQCKp0eTC0mCTYYFCc91rJ2zInIFtzNDTTLBOTQa3LW1Ia0jHZ4aWMnywVys8QT4gR9k/VaoGK970jQNgxKOCBtEwggbNMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUtFOxLxzdleDz2IiVVTcX1YBKVJcwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wgZkGA1UdEQEB/wSBjjCBi4aBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAfBgorBgEEAYO/MAECBBF3b3JrZmxvd19kaXNwYXRjaDA2BgorBgEEAYO/MAEDBChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCkGCisGAQQBg78wAQQEG3YyLjEgQXJ0aWZhY3QgUXVhbGlmaWNhdGlvbjAjBgorBgEEAYO/MAEFBBVZYW5nanVuamllLUxpbi9TY2FubHkwOwYKKwYBBAGDvzABBgQtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTCBmgYKKwYBBAGDvzABCQSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABCgQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMB0GCisGAQQBg78wAQsEDwwNZ2l0aHViLWhvc3RlZDA4BgorBgEEAYO/MAEMBCoMKGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkwOAYKKwYBBAGDvzABDQQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMD0GCisGAQQBg78wAQ4ELwwtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MBoGCisGAQQBg78wAQ8EDAwKMTE1NjM0MjY1MzAxBgorBgEEAYO/MAEQBCMMIWh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbjAZBgorBgEEAYO/MAERBAsMCTIyNDM3MDg5ODCBmgYKKwYBBAGDvzABEgSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABEwQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCEGCisGAQQBg78wARQEEwwRd29ya2Zsb3dfZGlzcGF0Y2gwXAYKKwYBBAGDvzABFQRODExodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5L2FjdGlvbnMvcnVucy8zNDc1NDY3MzU0Ny9hdHRlbXB0cy8xMBYGCisGAQQBg78wARYECAwGcHVibGljMFwGCisGAQQBg78wARgETgxMcmVwbzpZYW5nanVuamllLUxpbi9TY2FubHk6cmVmOnJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeTCBigYKKwYBBAHWeQIEAgR8BHoAeAB2AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABoJqKoeIAAAQDAEcwRQIhANnm71Bq7vBlEYGWy920xXRm0USli9D6wz2uu0e0lk9CAiBJQamLi6/5p8osYkZXvoyuAHLH9w0X6oQY6WJnP3SuHDAKBggqhkjOPQQDAwNnADBkAjAB5k0Qs8kShg3AMAdHOLN2bgZ5Iv7rhADR1gDcIZowm41kXxJItLC/EKlA2e5qAkwCMGtlPnNCi4QQmDSNRCMMBpz49EHSuVYH3g3w8H2R0ihOkYGO8Vl9sEEn98WLQDR/Ow==" + }, + "tlogEntries": [ + { + "logIndex": "2817433913", + "logId": { + "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=" + }, + "kindVersion": { + "kind": "dsse", + "version": "0.0.1" + }, + "integratedTime": "1789299171", + "inclusionPromise": { + "signedEntryTimestamp": "MEQCIAOG5A0waQ6j50hXljwn395wfEZlq0IkjTGQpuC7HwOZAiBWJINpQubbB57R6yaxrnBoxYlrKVhLwEL01NA2Df7uBQ==" + }, + "inclusionProof": { + "logIndex": "2695529651", + "rootHash": "Q5WqsVZN5nQHZiY3ZX8hcad69Pjx1lNTqn3JzWm95B4=", + "treeSize": "2695529676", + "hashes": [ + "qQHa9vCC7P7IAQh89MaPLACUm7ZHsEjsJ70/zk3pebk=", + "JZ8MMpCABC5xs0GYSJkYHlnXncDOc8dv46h0tKmNNtM=", + "wew1U61COyB1P4yWV3DNppZN5k7qDvMsiuvQmAVPxT0=", + "TcM3tNdf+nGJv9Qkln++16WFztmtWFZhXSLkLcEKkpk=", + "DRt4o3JqcjBBhq5jncq4BisO4fWCdxCQM9wFi/b9Y7o=", + "lq287jpsO/HKjECpVRIizHKz9aAirnmZuO0W+OmiSgU=", + "XgHGzw3VZ+NznHaIHV7lTix4Cn/ime0U0hmnnRK9bdU=", + "1Ggh254WnSIlwXgi8+eoA8Ei7pEeyYuGCoBSQpeojhU=", + "ys1AmRgOQ1cBbTrHqVAy0aCMdqJ6C/QxHXAD9GZhxmA=", + "99PoJTYgPWevn9oVlADbWdRGR90JL8Fx/FV0T06o0IA=", + "LQtwekqXPoO3KgXYEfRsV0WYK6Gk0PLLePxJWdZgThQ=", + "qOZd1StyLttRdZ9ojwet4/yO1QqFuSN2bQKQaTXLrkY=", + "uXYCZMF7lS28YUWZqw7VfMV5vdtFS6j7/bavDJtBebk=", + "S39m2eTD1rqRuAMs4r+sGsYIwW0BlTWuysWTKJ8RKVk=", + "qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=", + "xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY=" + ], + "checkpoint": { + "envelope": "rekor.sigstore.dev - 1193050959916656506\n2695529676\nQ5WqsVZN5nQHZiY3ZX8hcad69Pjx1lNTqn3JzWm95B4=\n\n— rekor.sigstore.dev wNI9ajBFAiEA+0D0scXW4lvw5uEIwowFz+/tXtC2uizMOnNGCOF9Vb4CIDSf8Qn8Y93iwQKNiJuQYCwuRDS/atfFiWAg7DEmjQYw\n" + } + }, + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiMDNiNTA2ZmY5MjgwMWQ4NmIwN2U1OGEwYjY3YWUwNWRiNWJmMjViMTFlNWYyYzJlMzllNzhiYzI0Yzc5YzY5YiJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImI3MmU5MWNiM2FlOWM0OGU1NGY0MzcwZjEzMGM1MDM1NDFmZDE0MmY3MGQ2NjI2ZTA3OWM2ODc3ODE4MzEyY2YifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVVQ0lHajVKV24xekt0STlpVmFIbjd1UFl4Yk5MUTBvaXhpamJJWWhSV0d5UUlkQWlFQWpVTW01c3RkaHZNa1l5OWxsTm84eW00N1NpNm0yVmllcjR6SVRrWTlZWG89IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VsTGVrTkRRamRMWjBGM1NVSkJaMGxWWVdKNVkxQjBSR1JyUmxaWlZISnBkMlE0TkdKd1QwMDNkSGhqZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwOVVSWHBOVkVWNlRXcFZlRmRvWTA1TmFsbDNUMVJGZWsxVVJUQk5hbFY0VjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVnVVV1JYVVVOTGNEQmxWRU13YlVOVVdWbEdRMk01TVhKS01ucEpia2xHZEhwT1JGUUtWRXhDVDFSUllUTk1WekZKWVRCcVNGbzBZVmROYm5sM1ZubHpPRkZVTkdkU09Xc3ZWbUZ2UjBzNU56QnFVVTVuZUV0UFEwSjBSWGRuWjJKT1RVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVjBSazk0Q2t4NGVtUnNaVVI2TWtscFZsWlVZMWd4V1VKTFZrcGpkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMmRhYTBkQk1WVmtSVkZGUWk5M1UwSnFha05DYVRSaFFtbEhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RRcGhiV3hzVEZWNGNHSnBPVlJaTWtaMVlraHJka3h0WkhCa1IyZ3hXV2s1TTJJelNuSmFiWGgyWkROTmRtUnFTWFZOVXpGb1kyNVNjRnB0Um1wa1F6RjRDbVJYUm5OaFYxcHdXVEpHTUdGWE9YVk1ibXgwWWtWQ2VWcFhXbnBNTW1oc1dWZFNla3d5VG5aYVIxWTBURE5aZVV4cVJYUmlia0owVEZoQ2VXSXpXbXdLWW0xR2RWa3lWWFJqYlZacVlqTmFiR051YTNkUFVWbExTM2RaUWtKQlIwUjJla0ZDUVZGUmNtRklVakJqU0UwMlRIazVNR0l5ZEd4aWFUVm9XVE5TY0FwaU1qVjZURzFrY0dSSGFERlpibFo2V2xoS2FtSXlOVEJhVnpVd1RHMU9kbUpVUVdaQ1oyOXlRbWRGUlVGWlR5OU5RVVZEUWtKR00ySXpTbkphYlhoMkNtUXhPV3RoV0U1M1dWaFNhbUZFUVRKQ1oyOXlRbWRGUlVGWlR5OU5RVVZFUWtOb2JFMXFTbXROVkVGM1RWUlplazVVV1RGTlZGa3dXbFJKZUU1RWJHMEtUMVJzYUZscVZUQmFSRVY0V1ZSWmVFMVVSVFZOZWtwcFRVTnJSME5wYzBkQlVWRkNaemM0ZDBGUlVVVkhNMWw1VEdwRloxRllTakJoVjFwb1dUTlJad3BWV0Zab1lrZHNiV0ZYVG1oa1IyeDJZbXBCYWtKbmIzSkNaMFZGUVZsUEwwMUJSVVpDUWxaYVdWYzFibUZ1Vm5WaGJXeHNURlY0Y0dKcE9WUlpNa1oxQ21KSWEzZFBkMWxMUzNkWlFrSkJSMFIyZWtGQ1FtZFJkR050Vm0xamVUbHZXbGRHYTJONU9XcGlNbEpzWlVNNU1rMXBOSGhNVnpWM1lsTXhkMk50T1RJS1dsYzFhR0p0VG14TVdFcHNXVEk1TWxwWVNqVk5SSE5IUTJselIwRlJVVUpuTnpoM1FWRm5SVXhSZDNKaFNGSXdZMGhOTmt4NU9UQmlNblJzWW1rMWFBcFpNMUp3WWpJMWVreHRaSEJrUjJneFdXNVdlbHBZU21waU1qVXdXbGMxTUV4dFRuWmlWRU5DYldkWlMwdDNXVUpDUVVkRWRucEJRa05SVTBKcGQzbENDbWxIYURCa1NFSjZUMms0ZGxveWJEQmhTRlpwVEcxT2RtSlRPVnBaVnpWdVlXNVdkV0Z0Ykd4TVZYaHdZbWs1VkZreVJuVmlTR3QyVEcxa2NHUkhhREVLV1drNU0ySXpTbkphYlhoMlpETk5kbVJxU1hWTlV6Rm9ZMjVTY0ZwdFJtcGtRekY0WkZkR2MyRlhXbkJaTWtZd1lWYzVkVXh1YkhSaVJVSjVXbGRhZWdwTU1taHNXVmRTZWt3eVRuWmFSMVkwVEROWmVVeHFSWFJpYmtKMFRGaENlV0l6V214aWJVWjFXVEpWZEdOdFZtcGlNMXBzWTI1cmQwOUJXVXRMZDFsQ0NrSkJSMFIyZWtGQ1EyZFJjVVJEYUd4TmFrcHJUVlJCZDAxVVdYcE9WRmt4VFZSWk1GcFVTWGhPUkd4dFQxUnNhRmxxVlRCYVJFVjRXVlJaZUUxVVJUVUtUWHBLYVUxQ01FZERhWE5IUVZGUlFtYzNPSGRCVVhORlJIZDNUbG95YkRCaFNGWnBURmRvZG1NelVteGFSRUUwUW1kdmNrSm5SVVZCV1U4dlRVRkZUUXBDUTI5TlMwZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNVdsbFhOVzVoYmxaMVlXMXNiRXhWZUhCaWFUbFVXVEpHZFdKSWEzZFBRVmxMQ2t0M1dVSkNRVWRFZG5wQlFrUlJVWEZFUTJoc1RXcEthMDFVUVhkTlZGbDZUbFJaTVUxVVdUQmFWRWw0VGtSc2JVOVViR2haYWxVd1drUkZlRmxVV1hnS1RWUkZOVTE2U21sTlJEQkhRMmx6UjBGUlVVSm5OemgzUVZFMFJVeDNkM1JqYlZadFkzazViMXBYUm10amVUbHFZakpTYkdWRE9USk5hVFI0VEZjMWR3cGlVekYzWTIwNU1scFhOV2hpYlU1c1RGaEtiRmt5T1RKYVdFbzFUVUp2UjBOcGMwZEJVVkZDWnpjNGQwRlJPRVZFUVhkTFRWUkZNVTVxVFRCTmFsa3hDazE2UVhoQ1oyOXlRbWRGUlVGWlR5OU5RVVZSUWtOTlRVbFhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnFRVnBDWjI5eVFtZEZSVUZaVHk5TlFVVlNRa0Z6VFVOVVNYbE9SRTB6VFVSbk5VOUVRMEp0WjFsTFMzZFpRa0pCUjBSMmVrRkNSV2RUUWdwcGQzbENhVWRvTUdSSVFucFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVXbGxYTlc1aGJsWjFZVzFzYkV4VmVIQmlhVGxVV1RKR2RXSklhM1pNYldSd0NtUkhhREZaYVRrellqTktjbHB0ZUhaa00wMTJaR3BKZFUxVE1XaGpibEp3V20xR2FtUkRNWGhrVjBaellWZGFjRmt5UmpCaFZ6bDFURzVzZEdKRlFua0tXbGRhZWt3eWFHeFpWMUo2VERKT2RscEhWalJNTTFsNVRHcEZkR0p1UW5STVdFSjVZak5hYkdKdFJuVlpNbFYwWTIxV2FtSXpXbXhqYm10M1QwRlpTd3BMZDFsQ1FrRkhSSFo2UVVKRmQxRnhSRU5vYkUxcVNtdE5WRUYzVFZSWmVrNVVXVEZOVkZrd1dsUkplRTVFYkcxUFZHeG9XV3BWTUZwRVJYaFpWRmw0Q2sxVVJUVk5la3BwVFVORlIwTnBjMGRCVVZGQ1p6YzRkMEZTVVVWRmQzZFNaREk1ZVdFeVduTmlNMlJtV2tkc2VtTkhSakJaTW1kM1dFRlpTMHQzV1VJS1FrRkhSSFo2UVVKR1VWSlBSRVY0YjJSSVVuZGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbGRYUm5WYU1uQXhZbTF3Y0ZwVE1VMWhWelIyVlRKT2FBcGliWGcxVERKR2FtUkhiSFppYmsxMlkyNVdkV041T0hwT1JHTXhUa1JaTTAxNlZUQk9lVGxvWkVoU2JHSllRakJqZVRoNFRVSlpSME5wYzBkQlVWRkNDbWMzT0hkQlVsbEZRMEYzUjJOSVZtbGlSMnhxVFVaM1IwTnBjMGRCVVZGQ1p6YzRkMEZTWjBWVVozaE5ZMjFXZDJKNmNGcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnBPVlJaTWtaMVlraHJObU50Vm0xUGJrcHNXbTVOZG1GSFZtaGFTRTEyV1RJNWExcFlaM1prYWtsMVRWTXhkV05ITUhSalNFcDJaRzFXZFFwWlZ6VnFXbE14ZVZwWFRuWmtiVlo1WlZSRFFtbG5XVXRMZDFsQ1FrRklWMlZSU1VWQloxSTRRa2h2UVdWQlFqSkJUakE1VFVkeVIzaDRSWGxaZUd0bENraEtiRzVPZDB0cFUydzJORE5xZVhRdk5HVkxZMjlCZGt0bE5rOUJRVUZDYjBweFMyOWxTVUZCUVZGRVFVVmpkMUpSU1doQlRtNXROekZDY1RkMlFtd0tSVmxIVjNrNU1qQjRXRkp0TUZWVGJHazVSRFozZWpKMWRUQmxNR3hyT1VOQmFVSktVV0Z0VEdrMkx6VndPRzl6V1d0YVdIWnZlWFZCU0V4SU9YY3dXQW8yYjFGWk5sZEtibEF6VTNWSVJFRkxRbWRuY1docmFrOVFVVkZFUVhkT2JrRkVRbXRCYWtGQ05Xc3dVWE00YTFOb1p6TkJUVUZrU0U5TVRqSmlaMW8xQ2tsMk4zSm9RVVJTTVdkRVkwbGFiM2R0TkRGcldIaEtTWFJNUXk5RlMyeEJNbVUxY1VGcmQwTk5SM1JzVUc1T1EyazBVVkZ0UkZOT1VrTk5UVUp3ZWpRS09VVklVM1ZXV1Vnelp6TjNPRWd5VWpCcGFFOXJXVWRQT0Zac09YTkZSVzQ1T0ZkTVVVUlNMMDkzUFQwS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9XX19" + } + ], + "timestampVerificationData": {} + }, + "dsseEnvelope": { + "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoicGtnOm5wbS8lNDBzY2FubHkvc2NlbmFyaW8tc2NoZW1hQDIuMS4wIiwiZGlnZXN0Ijp7InNoYTUxMiI6Ijk3M2ZjM2EzODdhOTc4ZjhmNTJlNjNhODJmNTc0Y2Y4MjljMmJkZDEyYmI1YjBhZDdmNTc2NjIwNmU4NjEwMjY5ZDBlNjlhYWU5MGViNDVmNTYwZjc5NGE5MjIzZjk0MjIwMTBkNTRiYzhhNDBlODJhZTMyYzAyNzQ2OGVkZGJlIn19XSwicHJlZGljYXRlVHlwZSI6Imh0dHBzOi8vc2xzYS5kZXYvcHJvdmVuYW5jZS92MSIsInByZWRpY2F0ZSI6eyJidWlsZERlZmluaXRpb24iOnsiYnVpbGRUeXBlIjoiaHR0cHM6Ly9zbHNhLWZyYW1ld29yay5naXRodWIuaW8vZ2l0aHViLWFjdGlvbnMtYnVpbGR0eXBlcy93b3JrZmxvdy92MSIsImV4dGVybmFsUGFyYW1ldGVycyI6eyJ3b3JrZmxvdyI6eyJyZWYiOiJyZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkiLCJyZXBvc2l0b3J5IjoiaHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seSIsInBhdGgiOiIuZ2l0aHViL3dvcmtmbG93cy92Mi4xLWFydGlmYWN0LXF1YWxpZmljYXRpb24ueW1sIn0sInNvdXJjZV9jb21taXQiOiI2YjAxN2I1M2E0NDA0ZjRmZWFiNzc2YWMxMTFiMGVhOWRhY2YyNzM0In0sImludGVybmFsUGFyYW1ldGVycyI6eyJnaXRodWIiOnsiZXZlbnRfbmFtZSI6IndvcmtmbG93X2Rpc3BhdGNoIiwicmVwb3NpdG9yeV9pZCI6IjExNTYzNDI2NTMiLCJyZXBvc2l0b3J5X293bmVyX2lkIjoiMjI0MzcwODk4In19LCJyZXNvbHZlZERlcGVuZGVuY2llcyI6W3sidXJpIjoiZ2l0K2h0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHlAcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5IiwiZGlnZXN0Ijp7ImdpdENvbW1pdCI6ImUyMmQxMDAxNjM1NjUxNjRlMjE0OWY5OWFiNTRkMTFhNjExMTkzMmIifX0seyJ1cmkiOiJnaXQraHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seUA2YjAxN2I1M2E0NDA0ZjRmZWFiNzc2YWMxMTFiMGVhOWRhY2YyNzM0IiwiZGlnZXN0Ijp7ImdpdENvbW1pdCI6IjZiMDE3YjUzYTQ0MDRmNGZlYWI3NzZhYzExMWIwZWE5ZGFjZjI3MzQifX1dfSwicnVuRGV0YWlscyI6eyJidWlsZGVyIjp7ImlkIjoiaHR0cHM6Ly9naXRodWIuY29tL2FjdGlvbnMvcnVubmVyL2dpdGh1Yi1ob3N0ZWQifSwibWV0YWRhdGEiOnsiaW52b2NhdGlvbklkIjoiaHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seS9hY3Rpb25zL3J1bnMvMzQ3NTQ2NzM1NDcvYXR0ZW1wdHMvMSJ9fX19", + "payloadType": "application/vnd.in-toto+json", + "signatures": [ + { + "sig": "MEUCIGj5JWn1zKtI9iVaHn7uPYxbNLQ0oixijbIYhRWGyQIdAiEAjUMm5stdhvMkYy9llNo8ym47Si6m2Vier4zITkY9YXo=" + } + ] + } +} diff --git a/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-url-safety-2.1.0.tgz.sigstore.json b/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-url-safety-2.1.0.tgz.sigstore.json new file mode 100644 index 0000000..04a45d0 --- /dev/null +++ b/release/stable/v2.1.0/publication-recovery/provenance-A/scanly-url-safety-2.1.0.tgz.sigstore.json @@ -0,0 +1,60 @@ +{ + "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", + "verificationMaterial": { + "certificate": { + "rawBytes": "MIIILDCCB7GgAwIBAgIUJKid6FzC71y0GwPLgxjIAtkkb7swCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTEzMTEzMjUyWhcNMjYwOTEzMTE0MjUyWjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEfvF7BNzf8brAS2QR6pB5PaPVcCEsKgEra02S0PU3a7hIrryPDL2ZQJeFnhZoZoxYRtHcg3K54Z74hUl3+56wW6OCBtAwggbMMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUKstj08X5FENv+FsM15d3uVgW5ukwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wgZkGA1UdEQEB/wSBjjCBi4aBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAfBgorBgEEAYO/MAECBBF3b3JrZmxvd19kaXNwYXRjaDA2BgorBgEEAYO/MAEDBChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCkGCisGAQQBg78wAQQEG3YyLjEgQXJ0aWZhY3QgUXVhbGlmaWNhdGlvbjAjBgorBgEEAYO/MAEFBBVZYW5nanVuamllLUxpbi9TY2FubHkwOwYKKwYBBAGDvzABBgQtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTCBmgYKKwYBBAGDvzABCQSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABCgQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMB0GCisGAQQBg78wAQsEDwwNZ2l0aHViLWhvc3RlZDA4BgorBgEEAYO/MAEMBCoMKGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkwOAYKKwYBBAGDvzABDQQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMD0GCisGAQQBg78wAQ4ELwwtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MBoGCisGAQQBg78wAQ8EDAwKMTE1NjM0MjY1MzAxBgorBgEEAYO/MAEQBCMMIWh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbjAZBgorBgEEAYO/MAERBAsMCTIyNDM3MDg5ODCBmgYKKwYBBAGDvzABEgSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABEwQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCEGCisGAQQBg78wARQEEwwRd29ya2Zsb3dfZGlzcGF0Y2gwXAYKKwYBBAGDvzABFQRODExodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5L2FjdGlvbnMvcnVucy8zNDc1NDY3MzU0Ny9hdHRlbXB0cy8xMBYGCisGAQQBg78wARYECAwGcHVibGljMFwGCisGAQQBg78wARgETgxMcmVwbzpZYW5nanVuamllLUxpbi9TY2FubHk6cmVmOnJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeTCBiQYKKwYBBAHWeQIEAgR7BHkAdwB1AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABoJqKpbQAAAQDAEYwRAIgdxytucmEH+vDPBNz54A5uL0AcbGJqewtGpYWo8txnpwCIBP2myWpDYKBkrHrC93fs7AqyX/babkluXarhrAlYzlbMAoGCCqGSM49BAMDA2kAMGYCMQCgmvGQNi29iSATJx3R7QwQS9/nWLx6Dy1D6hKJEZL5gsDrJLRVBFIPqeT8PDEFItMCMQCr11jPGmMHpWp6I54uwOxsh0vcxFZuUrGmYY24o5S7/IE6WNrFaliWKV3OgXS59GE=" + }, + "tlogEntries": [ + { + "logIndex": "2817434045", + "logId": { + "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=" + }, + "kindVersion": { + "kind": "dsse", + "version": "0.0.1" + }, + "integratedTime": "1789299172", + "inclusionPromise": { + "signedEntryTimestamp": "MEUCIE97wpdbJTsOQf13fgysfLms5CilS2pKS3nxL+iQY14dAiEA8Bnwx7JvRfdDtutit2lQw5chu23hS89mWg3bGn4YZXM=" + }, + "inclusionProof": { + "logIndex": "2695529783", + "rootHash": "yQlyTTeo9mZjwY+F9ReszVfvyTA2fNkDDMl/m4gN0yU=", + "treeSize": "2695529792", + "hashes": [ + "JYOxkhe3vd0rwtCZcUEnRZTBx5eBPTCySgZfGESj6aM=", + "3acj/61WEDmfEMnkRqwRuAys3e8EzsGQC4N0SbGXu6I=", + "BuXZ7zUHXc8VKUYu3api01+MdiWXYjJR3+RDCfMpxa8=", + "cOqAumENUgUU7ITguNb+JdB77hA5EX+mxB7ug4vb25I=", + "JbIGiaj7KxYLP6eoDsrmFNIYhjPj8aRJRawAAALuhfk=", + "DKralLrA9RKWuoh1xKhysGf35LossLSA9dHZ/r0+UCk=", + "kdla8MzFBhwDILy05yGsk7TUXVwm7RUcoVF7mG30esM=", + "ys1AmRgOQ1cBbTrHqVAy0aCMdqJ6C/QxHXAD9GZhxmA=", + "99PoJTYgPWevn9oVlADbWdRGR90JL8Fx/FV0T06o0IA=", + "LQtwekqXPoO3KgXYEfRsV0WYK6Gk0PLLePxJWdZgThQ=", + "qOZd1StyLttRdZ9ojwet4/yO1QqFuSN2bQKQaTXLrkY=", + "uXYCZMF7lS28YUWZqw7VfMV5vdtFS6j7/bavDJtBebk=", + "S39m2eTD1rqRuAMs4r+sGsYIwW0BlTWuysWTKJ8RKVk=", + "qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=", + "xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY=" + ], + "checkpoint": { + "envelope": "rekor.sigstore.dev - 1193050959916656506\n2695529792\nyQlyTTeo9mZjwY+F9ReszVfvyTA2fNkDDMl/m4gN0yU=\n\n— rekor.sigstore.dev wNI9ajBEAiBuy5vgier8H95bYHILyGTLuWh458omjc1h1rTUA8KxXAIgR1zux2ecswSDOEcWGOuD3SGSRMv+adcxjPQuPfNcLgE=\n" + } + }, + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiMTdkMGZlOGIwZTBmNzYxYTMxZDYwYWZiYzMwYTc4ZDA5MGJlZmZkYWNkNmYwMWJmMzIxZjY5NTg5MDBjZGRjZSJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjZjNDViZGQxMDQ2Nzg1NDJkZTE3ZjdmOGNkNWM0ZjlhM2RhN2ZmZGY4YWE1MGYzNzViZDY4YTc2ZGE5ODA1NjQifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVZQ0lRRGpvdVljNWxRVDFXUUcrdkdTN2xPYXdxQ29KYVNlcm42VXp4UmZMOEJJUHdJaEFKblZ1S0U1QkhGUE9ydHdrWnBwOE9vWFkyei9XT0VSZndMM2dWTk83UmlJIiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VsTVJFTkRRamRIWjBGM1NVSkJaMGxWU2t0cFpEWkdla00zTVhrd1IzZFFUR2Q0YWtsQmRHdHJZamR6ZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwOVVSWHBOVkVWNlRXcFZlVmRvWTA1TmFsbDNUMVJGZWsxVVJUQk5hbFY1VjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVm1ka1kzUWs1NlpqaGlja0ZUTWxGU05uQkNOVkJoVUZaalEwVnpTMmRGY21Fd01sTUtNRkJWTTJFM2FFbHljbmxRUkV3eVdsRktaVVp1YUZwdldtOTRXVkowU0dObk0wczFORm8zTkdoVmJETXJOVFozVnpaUFEwSjBRWGRuWjJKTlRVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVkxjM1JxQ2pBNFdEVkdSVTUySzBaelRURTFaRE4xVm1kWE5YVnJkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMmRhYTBkQk1WVmtSVkZGUWk5M1UwSnFha05DYVRSaFFtbEhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RRcGhiV3hzVEZWNGNHSnBPVlJaTWtaMVlraHJka3h0WkhCa1IyZ3hXV2s1TTJJelNuSmFiWGgyWkROTmRtUnFTWFZOVXpGb1kyNVNjRnB0Um1wa1F6RjRDbVJYUm5OaFYxcHdXVEpHTUdGWE9YVk1ibXgwWWtWQ2VWcFhXbnBNTW1oc1dWZFNla3d5VG5aYVIxWTBURE5aZVV4cVJYUmlia0owVEZoQ2VXSXpXbXdLWW0xR2RWa3lWWFJqYlZacVlqTmFiR051YTNkUFVWbExTM2RaUWtKQlIwUjJla0ZDUVZGUmNtRklVakJqU0UwMlRIazVNR0l5ZEd4aWFUVm9XVE5TY0FwaU1qVjZURzFrY0dSSGFERlpibFo2V2xoS2FtSXlOVEJhVnpVd1RHMU9kbUpVUVdaQ1oyOXlRbWRGUlVGWlR5OU5RVVZEUWtKR00ySXpTbkphYlhoMkNtUXhPV3RoV0U1M1dWaFNhbUZFUVRKQ1oyOXlRbWRGUlVGWlR5OU5RVVZFUWtOb2JFMXFTbXROVkVGM1RWUlplazVVV1RGTlZGa3dXbFJKZUU1RWJHMEtUMVJzYUZscVZUQmFSRVY0V1ZSWmVFMVVSVFZOZWtwcFRVTnJSME5wYzBkQlVWRkNaemM0ZDBGUlVVVkhNMWw1VEdwRloxRllTakJoVjFwb1dUTlJad3BWV0Zab1lrZHNiV0ZYVG1oa1IyeDJZbXBCYWtKbmIzSkNaMFZGUVZsUEwwMUJSVVpDUWxaYVdWYzFibUZ1Vm5WaGJXeHNURlY0Y0dKcE9WUlpNa1oxQ21KSWEzZFBkMWxMUzNkWlFrSkJSMFIyZWtGQ1FtZFJkR050Vm0xamVUbHZXbGRHYTJONU9XcGlNbEpzWlVNNU1rMXBOSGhNVnpWM1lsTXhkMk50T1RJS1dsYzFhR0p0VG14TVdFcHNXVEk1TWxwWVNqVk5SSE5IUTJselIwRlJVVUpuTnpoM1FWRm5SVXhSZDNKaFNGSXdZMGhOTmt4NU9UQmlNblJzWW1rMWFBcFpNMUp3WWpJMWVreHRaSEJrUjJneFdXNVdlbHBZU21waU1qVXdXbGMxTUV4dFRuWmlWRU5DYldkWlMwdDNXVUpDUVVkRWRucEJRa05SVTBKcGQzbENDbWxIYURCa1NFSjZUMms0ZGxveWJEQmhTRlpwVEcxT2RtSlRPVnBaVnpWdVlXNVdkV0Z0Ykd4TVZYaHdZbWs1VkZreVJuVmlTR3QyVEcxa2NHUkhhREVLV1drNU0ySXpTbkphYlhoMlpETk5kbVJxU1hWTlV6Rm9ZMjVTY0ZwdFJtcGtRekY0WkZkR2MyRlhXbkJaTWtZd1lWYzVkVXh1YkhSaVJVSjVXbGRhZWdwTU1taHNXVmRTZWt3eVRuWmFSMVkwVEROWmVVeHFSWFJpYmtKMFRGaENlV0l6V214aWJVWjFXVEpWZEdOdFZtcGlNMXBzWTI1cmQwOUJXVXRMZDFsQ0NrSkJSMFIyZWtGQ1EyZFJjVVJEYUd4TmFrcHJUVlJCZDAxVVdYcE9WRmt4VFZSWk1GcFVTWGhPUkd4dFQxUnNhRmxxVlRCYVJFVjRXVlJaZUUxVVJUVUtUWHBLYVUxQ01FZERhWE5IUVZGUlFtYzNPSGRCVVhORlJIZDNUbG95YkRCaFNGWnBURmRvZG1NelVteGFSRUUwUW1kdmNrSm5SVVZCV1U4dlRVRkZUUXBDUTI5TlMwZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNVdsbFhOVzVoYmxaMVlXMXNiRXhWZUhCaWFUbFVXVEpHZFdKSWEzZFBRVmxMQ2t0M1dVSkNRVWRFZG5wQlFrUlJVWEZFUTJoc1RXcEthMDFVUVhkTlZGbDZUbFJaTVUxVVdUQmFWRWw0VGtSc2JVOVViR2haYWxVd1drUkZlRmxVV1hnS1RWUkZOVTE2U21sTlJEQkhRMmx6UjBGUlVVSm5OemgzUVZFMFJVeDNkM1JqYlZadFkzazViMXBYUm10amVUbHFZakpTYkdWRE9USk5hVFI0VEZjMWR3cGlVekYzWTIwNU1scFhOV2hpYlU1c1RGaEtiRmt5T1RKYVdFbzFUVUp2UjBOcGMwZEJVVkZDWnpjNGQwRlJPRVZFUVhkTFRWUkZNVTVxVFRCTmFsa3hDazE2UVhoQ1oyOXlRbWRGUlVGWlR5OU5RVVZSUWtOTlRVbFhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnFRVnBDWjI5eVFtZEZSVUZaVHk5TlFVVlNRa0Z6VFVOVVNYbE9SRTB6VFVSbk5VOUVRMEp0WjFsTFMzZFpRa0pCUjBSMmVrRkNSV2RUUWdwcGQzbENhVWRvTUdSSVFucFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVXbGxYTlc1aGJsWjFZVzFzYkV4VmVIQmlhVGxVV1RKR2RXSklhM1pNYldSd0NtUkhhREZaYVRrellqTktjbHB0ZUhaa00wMTJaR3BKZFUxVE1XaGpibEp3V20xR2FtUkRNWGhrVjBaellWZGFjRmt5UmpCaFZ6bDFURzVzZEdKRlFua0tXbGRhZWt3eWFHeFpWMUo2VERKT2RscEhWalJNTTFsNVRHcEZkR0p1UW5STVdFSjVZak5hYkdKdFJuVlpNbFYwWTIxV2FtSXpXbXhqYm10M1QwRlpTd3BMZDFsQ1FrRkhSSFo2UVVKRmQxRnhSRU5vYkUxcVNtdE5WRUYzVFZSWmVrNVVXVEZOVkZrd1dsUkplRTVFYkcxUFZHeG9XV3BWTUZwRVJYaFpWRmw0Q2sxVVJUVk5la3BwVFVORlIwTnBjMGRCVVZGQ1p6YzRkMEZTVVVWRmQzZFNaREk1ZVdFeVduTmlNMlJtV2tkc2VtTkhSakJaTW1kM1dFRlpTMHQzV1VJS1FrRkhSSFo2UVVKR1VWSlBSRVY0YjJSSVVuZGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbGRYUm5WYU1uQXhZbTF3Y0ZwVE1VMWhWelIyVlRKT2FBcGliWGcxVERKR2FtUkhiSFppYmsxMlkyNVdkV041T0hwT1JHTXhUa1JaTTAxNlZUQk9lVGxvWkVoU2JHSllRakJqZVRoNFRVSlpSME5wYzBkQlVWRkNDbWMzT0hkQlVsbEZRMEYzUjJOSVZtbGlSMnhxVFVaM1IwTnBjMGRCVVZGQ1p6YzRkMEZTWjBWVVozaE5ZMjFXZDJKNmNGcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnBPVlJaTWtaMVlraHJObU50Vm0xUGJrcHNXbTVOZG1GSFZtaGFTRTEyV1RJNWExcFlaM1prYWtsMVRWTXhkV05ITUhSalNFcDJaRzFXZFFwWlZ6VnFXbE14ZVZwWFRuWmtiVlo1WlZSRFFtbFJXVXRMZDFsQ1FrRklWMlZSU1VWQloxSTNRa2hyUVdSM1FqRkJUakE1VFVkeVIzaDRSWGxaZUd0bENraEtiRzVPZDB0cFUydzJORE5xZVhRdk5HVkxZMjlCZGt0bE5rOUJRVUZDYjBweFMzQmlVVUZCUVZGRVFVVlpkMUpCU1dka2VIbDBkV050UlVncmRrUUtVRUpPZWpVMFFUVjFUREJCWTJKSFNuRmxkM1JIY0ZsWGJ6aDBlRzV3ZDBOSlFsQXliWGxYY0VSWlMwSnJja2h5UXprelpuTTNRWEY1V0M5aVlXSnJiQXAxV0dGeWFISkJiRmw2YkdKTlFXOUhRME54UjFOTk5EbENRVTFFUVRKclFVMUhXVU5OVVVObmJYWkhVVTVwTWpscFUwRlVTbmd6VWpkUmQxRlRPUzl1Q2xkTWVEWkVlVEZFTm1oTFNrVmFURFZuYzBSeVNreFNWa0pHU1ZCeFpWUTRVRVJGUmtsMFRVTk5VVU55TVRGcVVFZHRUVWh3VjNBMlNUVTBkWGRQZUhNS2FEQjJZM2hHV25WVmNrZHRXVmt5Tkc4MVV6Y3ZTVVUyVjA1eVJtRnNhVmRMVmpOUFoxaFROVGxIUlQwS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9XX19" + } + ], + "timestampVerificationData": {} + }, + "dsseEnvelope": { + "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoicGtnOm5wbS8lNDBzY2FubHkvdXJsLXNhZmV0eUAyLjEuMCIsImRpZ2VzdCI6eyJzaGE1MTIiOiIyNjllMmYyZWQ3ZGJiNzE5MjZiMWVhZjMzZTA2ZGY4ZWQxN2NmMWEwYWExNmI3NDEyNTJmYTJjNTlhMzkyOTU4OGQ3NTQ5ZTVhYTY2NTVkMTQyYmZmMWIxOTgwM2RiOGFkNWJmMzk0OTU2MmRmNGQ2NWViYTUzYTg0ZDUzMWM1ZSJ9fV0sInByZWRpY2F0ZVR5cGUiOiJodHRwczovL3Nsc2EuZGV2L3Byb3ZlbmFuY2UvdjEiLCJwcmVkaWNhdGUiOnsiYnVpbGREZWZpbml0aW9uIjp7ImJ1aWxkVHlwZSI6Imh0dHBzOi8vc2xzYS1mcmFtZXdvcmsuZ2l0aHViLmlvL2dpdGh1Yi1hY3Rpb25zLWJ1aWxkdHlwZXMvd29ya2Zsb3cvdjEiLCJleHRlcm5hbFBhcmFtZXRlcnMiOnsid29ya2Zsb3ciOnsicmVmIjoicmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5IiwicmVwb3NpdG9yeSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkiLCJwYXRoIjoiLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbCJ9LCJzb3VyY2VfY29tbWl0IjoiNmIwMTdiNTNhNDQwNGY0ZmVhYjc3NmFjMTExYjBlYTlkYWNmMjczNCJ9LCJpbnRlcm5hbFBhcmFtZXRlcnMiOnsiZ2l0aHViIjp7ImV2ZW50X25hbWUiOiJ3b3JrZmxvd19kaXNwYXRjaCIsInJlcG9zaXRvcnlfaWQiOiIxMTU2MzQyNjUzIiwicmVwb3NpdG9yeV9vd25lcl9pZCI6IjIyNDM3MDg5OCJ9fSwicmVzb2x2ZWREZXBlbmRlbmNpZXMiOlt7InVyaSI6ImdpdCtodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5QHJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeSIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiJlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiIn19LHsidXJpIjoiZ2l0K2h0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHlANmIwMTdiNTNhNDQwNGY0ZmVhYjc3NmFjMTExYjBlYTlkYWNmMjczNCIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiI2YjAxN2I1M2E0NDA0ZjRmZWFiNzc2YWMxMTFiMGVhOWRhY2YyNzM0In19XX0sInJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY3Rpb25zL3J1bm5lci9naXRodWItaG9zdGVkIn0sIm1ldGFkYXRhIjp7Imludm9jYXRpb25JZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvYWN0aW9ucy9ydW5zLzM0NzU0NjczNTQ3L2F0dGVtcHRzLzEifX19fQ==", + "payloadType": "application/vnd.in-toto+json", + "signatures": [ + { + "sig": "MEYCIQDjouYc5lQT1WQG+vGS7lOawqCoJaSern6UzxRfL8BIPwIhAJnVuKE5BHFPOrtwkZpp8OoXY2z/WOERfwL3gVNO7RiI" + } + ] + } +} diff --git a/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-benchmark-2.1.0.tgz.sigstore.json b/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-benchmark-2.1.0.tgz.sigstore.json new file mode 100644 index 0000000..739d255 --- /dev/null +++ b/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-benchmark-2.1.0.tgz.sigstore.json @@ -0,0 +1,61 @@ +{ + "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", + "verificationMaterial": { + "certificate": { + "rawBytes": "MIIIKzCCB7GgAwIBAgIUXTpTgm0EUDvvEL4PgyetoMuEq58wCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTEzMTEzMjUzWhcNMjYwOTEzMTE0MjUzWjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2t717eJQswcjZoxzMORZc+5RnuLbjXaipzpBOpsuEUhIAXB89cRPdE1Bz8c4kToaMQvArnD/fssToGEmqZJ4zKOCBtAwggbMMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUXmbOERcKwcbF7oysriR9z32UWrwwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wgZkGA1UdEQEB/wSBjjCBi4aBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAfBgorBgEEAYO/MAECBBF3b3JrZmxvd19kaXNwYXRjaDA2BgorBgEEAYO/MAEDBChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCkGCisGAQQBg78wAQQEG3YyLjEgQXJ0aWZhY3QgUXVhbGlmaWNhdGlvbjAjBgorBgEEAYO/MAEFBBVZYW5nanVuamllLUxpbi9TY2FubHkwOwYKKwYBBAGDvzABBgQtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTCBmgYKKwYBBAGDvzABCQSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABCgQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMB0GCisGAQQBg78wAQsEDwwNZ2l0aHViLWhvc3RlZDA4BgorBgEEAYO/MAEMBCoMKGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkwOAYKKwYBBAGDvzABDQQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMD0GCisGAQQBg78wAQ4ELwwtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MBoGCisGAQQBg78wAQ8EDAwKMTE1NjM0MjY1MzAxBgorBgEEAYO/MAEQBCMMIWh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbjAZBgorBgEEAYO/MAERBAsMCTIyNDM3MDg5ODCBmgYKKwYBBAGDvzABEgSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABEwQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCEGCisGAQQBg78wARQEEwwRd29ya2Zsb3dfZGlzcGF0Y2gwXAYKKwYBBAGDvzABFQRODExodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5L2FjdGlvbnMvcnVucy8zNDc1NDY3MzU0Ny9hdHRlbXB0cy8xMBYGCisGAQQBg78wARYECAwGcHVibGljMFwGCisGAQQBg78wARgETgxMcmVwbzpZYW5nanVuamllLUxpbi9TY2FubHk6cmVmOnJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeTCBiQYKKwYBBAHWeQIEAgR7BHkAdwB1AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABoJqKptYAAAQDAEYwRAIgHwiMA+Qh5GpOpwgGp+fC+JuWVWnlwlzBnLHHEqTkGfQCIEltkrPWQ5tR8wXVD1p+V6zr3VGlMgzeUt2FhWUxa13SMAoGCCqGSM49BAMDA2gAMGUCMH4pg7qyRwCCtIhyFyyDBbZ2z8fwd4OhyL4X7bJwMo5nD0gkP+8uxPa3w3mEcUWfigIxANGGRFK8InHDVE6ZyQBnsqAQ/+Z/6+yO07z5AolXGdAkzpp3XBOGz8X0CtDDnMPjCA==" + }, + "tlogEntries": [ + { + "logIndex": "2817434102", + "logId": { + "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=" + }, + "kindVersion": { + "kind": "dsse", + "version": "0.0.1" + }, + "integratedTime": "1789299173", + "inclusionPromise": { + "signedEntryTimestamp": "MEYCIQCOtU2l9QQ5Ulgmwv+J3pVWeW0vxZegq5+j14DU373SrQIhAPaC2gu7HbUSH36ycKCKxVyvvo2q4qzC2gMR32TSKQ/G" + }, + "inclusionProof": { + "logIndex": "2695529840", + "rootHash": "S299qvXE5DG/UrxolqX3KJOiuLlZtvebczQvUfbzHVo=", + "treeSize": "2695529851", + "hashes": [ + "YpiRta/IfHw3m/zi8KrLCc8cK2y9K4mro/QidgZZBrQ=", + "NECWF2uh4Vhe+K/kApsw7fU8fxsnu+7evckfzpLYY5E=", + "QBntO69wkQ/lgqV7pJDsW6kfT7IqGus34HckDRhdeyA=", + "t5dCQ0lQAM96q3CixZzslDjdCtBXCzMVK0JWWYkMt/Y=", + "kgqVv1he3g/MLyx+kFTRAtUeQXC/4/HMe4u46FQUV6s=", + "krlfZdczuWeYnMBMUNps5g+k1Biw3pSVtfyKgovb7Mw=", + "poO2eeWwuT5o6g0TM/brTSO1KzfPzEeYUA5NdxAtksM=", + "kdla8MzFBhwDILy05yGsk7TUXVwm7RUcoVF7mG30esM=", + "ys1AmRgOQ1cBbTrHqVAy0aCMdqJ6C/QxHXAD9GZhxmA=", + "99PoJTYgPWevn9oVlADbWdRGR90JL8Fx/FV0T06o0IA=", + "LQtwekqXPoO3KgXYEfRsV0WYK6Gk0PLLePxJWdZgThQ=", + "qOZd1StyLttRdZ9ojwet4/yO1QqFuSN2bQKQaTXLrkY=", + "uXYCZMF7lS28YUWZqw7VfMV5vdtFS6j7/bavDJtBebk=", + "S39m2eTD1rqRuAMs4r+sGsYIwW0BlTWuysWTKJ8RKVk=", + "qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=", + "xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY=" + ], + "checkpoint": { + "envelope": "rekor.sigstore.dev - 1193050959916656506\n2695529851\nS299qvXE5DG/UrxolqX3KJOiuLlZtvebczQvUfbzHVo=\n\n— rekor.sigstore.dev wNI9ajBGAiEAs3bTmztvAf+h6EG4s5bHmGazNnQpCgoBOQgOliITUw8CIQCLbmQfCYyhrIuS7yDml8I6ozPQ76/tG0BGGzl8nxNKrw==\n" + } + }, + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiMTg3MjVhMmJmYmZmOTQ5NjE0ZTQ1YTllNGU1NjM3OGFlM2ZhZDQ0NTg3YzY1OThlZjBlNGFiYjgwZTc3ZmU0NSJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjM5YjQ5ZTBjYjQ3NTllNzA5OWI1N2YyNzBlNmNmMTljZWZmOWNjYTJiMWI0NmNjYmRiNTNiNjM5NWUyNDg5YzcifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVVQ0lRRHBUaTBYOXJDcS9CKzBBRzI1M1N2OVZuUXNJZkQ2UzNuVm55UW5tczdHQ3dJZ05Ya1IreThUNTIyY3F4TDgrM3N6c2dxTXdYcTBwdWt0Z2VoQXZGWndGOUU9IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VsTGVrTkRRamRIWjBGM1NVSkJaMGxWV0ZSd1ZHZHRNRVZWUkhaMlJVdzBVR2Q1WlhSdlRYVkZjVFU0ZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwOVVSWHBOVkVWNlRXcFZlbGRvWTA1TmFsbDNUMVJGZWsxVVJUQk5hbFY2VjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVXlkRGN4TjJWS1VYTjNZMnBhYjNoNlRVOVNXbU1yTlZKdWRVeGlhbGhoYVhCNmNFSUtUM0J6ZFVWVmFFbEJXRUk0T1dOU1VHUkZNVUo2T0dNMGExUnZZVTFSZGtGeWJrUXZabk56Vkc5SFJXMXhXa28wZWt0UFEwSjBRWGRuWjJKTlRVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVlliV0pQQ2tWU1kwdDNZMkpHTjI5NWMzSnBVamw2TXpKVlYzSjNkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMmRhYTBkQk1WVmtSVkZGUWk5M1UwSnFha05DYVRSaFFtbEhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RRcGhiV3hzVEZWNGNHSnBPVlJaTWtaMVlraHJka3h0WkhCa1IyZ3hXV2s1TTJJelNuSmFiWGgyWkROTmRtUnFTWFZOVXpGb1kyNVNjRnB0Um1wa1F6RjRDbVJYUm5OaFYxcHdXVEpHTUdGWE9YVk1ibXgwWWtWQ2VWcFhXbnBNTW1oc1dWZFNla3d5VG5aYVIxWTBURE5aZVV4cVJYUmlia0owVEZoQ2VXSXpXbXdLWW0xR2RWa3lWWFJqYlZacVlqTmFiR051YTNkUFVWbExTM2RaUWtKQlIwUjJla0ZDUVZGUmNtRklVakJqU0UwMlRIazVNR0l5ZEd4aWFUVm9XVE5TY0FwaU1qVjZURzFrY0dSSGFERlpibFo2V2xoS2FtSXlOVEJhVnpVd1RHMU9kbUpVUVdaQ1oyOXlRbWRGUlVGWlR5OU5RVVZEUWtKR00ySXpTbkphYlhoMkNtUXhPV3RoV0U1M1dWaFNhbUZFUVRKQ1oyOXlRbWRGUlVGWlR5OU5RVVZFUWtOb2JFMXFTbXROVkVGM1RWUlplazVVV1RGTlZGa3dXbFJKZUU1RWJHMEtUMVJzYUZscVZUQmFSRVY0V1ZSWmVFMVVSVFZOZWtwcFRVTnJSME5wYzBkQlVWRkNaemM0ZDBGUlVVVkhNMWw1VEdwRloxRllTakJoVjFwb1dUTlJad3BWV0Zab1lrZHNiV0ZYVG1oa1IyeDJZbXBCYWtKbmIzSkNaMFZGUVZsUEwwMUJSVVpDUWxaYVdWYzFibUZ1Vm5WaGJXeHNURlY0Y0dKcE9WUlpNa1oxQ21KSWEzZFBkMWxMUzNkWlFrSkJSMFIyZWtGQ1FtZFJkR050Vm0xamVUbHZXbGRHYTJONU9XcGlNbEpzWlVNNU1rMXBOSGhNVnpWM1lsTXhkMk50T1RJS1dsYzFhR0p0VG14TVdFcHNXVEk1TWxwWVNqVk5SSE5IUTJselIwRlJVVUpuTnpoM1FWRm5SVXhSZDNKaFNGSXdZMGhOTmt4NU9UQmlNblJzWW1rMWFBcFpNMUp3WWpJMWVreHRaSEJrUjJneFdXNVdlbHBZU21waU1qVXdXbGMxTUV4dFRuWmlWRU5DYldkWlMwdDNXVUpDUVVkRWRucEJRa05SVTBKcGQzbENDbWxIYURCa1NFSjZUMms0ZGxveWJEQmhTRlpwVEcxT2RtSlRPVnBaVnpWdVlXNVdkV0Z0Ykd4TVZYaHdZbWs1VkZreVJuVmlTR3QyVEcxa2NHUkhhREVLV1drNU0ySXpTbkphYlhoMlpETk5kbVJxU1hWTlV6Rm9ZMjVTY0ZwdFJtcGtRekY0WkZkR2MyRlhXbkJaTWtZd1lWYzVkVXh1YkhSaVJVSjVXbGRhZWdwTU1taHNXVmRTZWt3eVRuWmFSMVkwVEROWmVVeHFSWFJpYmtKMFRGaENlV0l6V214aWJVWjFXVEpWZEdOdFZtcGlNMXBzWTI1cmQwOUJXVXRMZDFsQ0NrSkJSMFIyZWtGQ1EyZFJjVVJEYUd4TmFrcHJUVlJCZDAxVVdYcE9WRmt4VFZSWk1GcFVTWGhPUkd4dFQxUnNhRmxxVlRCYVJFVjRXVlJaZUUxVVJUVUtUWHBLYVUxQ01FZERhWE5IUVZGUlFtYzNPSGRCVVhORlJIZDNUbG95YkRCaFNGWnBURmRvZG1NelVteGFSRUUwUW1kdmNrSm5SVVZCV1U4dlRVRkZUUXBDUTI5TlMwZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNVdsbFhOVzVoYmxaMVlXMXNiRXhWZUhCaWFUbFVXVEpHZFdKSWEzZFBRVmxMQ2t0M1dVSkNRVWRFZG5wQlFrUlJVWEZFUTJoc1RXcEthMDFVUVhkTlZGbDZUbFJaTVUxVVdUQmFWRWw0VGtSc2JVOVViR2haYWxVd1drUkZlRmxVV1hnS1RWUkZOVTE2U21sTlJEQkhRMmx6UjBGUlVVSm5OemgzUVZFMFJVeDNkM1JqYlZadFkzazViMXBYUm10amVUbHFZakpTYkdWRE9USk5hVFI0VEZjMWR3cGlVekYzWTIwNU1scFhOV2hpYlU1c1RGaEtiRmt5T1RKYVdFbzFUVUp2UjBOcGMwZEJVVkZDWnpjNGQwRlJPRVZFUVhkTFRWUkZNVTVxVFRCTmFsa3hDazE2UVhoQ1oyOXlRbWRGUlVGWlR5OU5RVVZSUWtOTlRVbFhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnFRVnBDWjI5eVFtZEZSVUZaVHk5TlFVVlNRa0Z6VFVOVVNYbE9SRTB6VFVSbk5VOUVRMEp0WjFsTFMzZFpRa0pCUjBSMmVrRkNSV2RUUWdwcGQzbENhVWRvTUdSSVFucFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVXbGxYTlc1aGJsWjFZVzFzYkV4VmVIQmlhVGxVV1RKR2RXSklhM1pNYldSd0NtUkhhREZaYVRrellqTktjbHB0ZUhaa00wMTJaR3BKZFUxVE1XaGpibEp3V20xR2FtUkRNWGhrVjBaellWZGFjRmt5UmpCaFZ6bDFURzVzZEdKRlFua0tXbGRhZWt3eWFHeFpWMUo2VERKT2RscEhWalJNTTFsNVRHcEZkR0p1UW5STVdFSjVZak5hYkdKdFJuVlpNbFYwWTIxV2FtSXpXbXhqYm10M1QwRlpTd3BMZDFsQ1FrRkhSSFo2UVVKRmQxRnhSRU5vYkUxcVNtdE5WRUYzVFZSWmVrNVVXVEZOVkZrd1dsUkplRTVFYkcxUFZHeG9XV3BWTUZwRVJYaFpWRmw0Q2sxVVJUVk5la3BwVFVORlIwTnBjMGRCVVZGQ1p6YzRkMEZTVVVWRmQzZFNaREk1ZVdFeVduTmlNMlJtV2tkc2VtTkhSakJaTW1kM1dFRlpTMHQzV1VJS1FrRkhSSFo2UVVKR1VWSlBSRVY0YjJSSVVuZGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbGRYUm5WYU1uQXhZbTF3Y0ZwVE1VMWhWelIyVlRKT2FBcGliWGcxVERKR2FtUkhiSFppYmsxMlkyNVdkV041T0hwT1JHTXhUa1JaTTAxNlZUQk9lVGxvWkVoU2JHSllRakJqZVRoNFRVSlpSME5wYzBkQlVWRkNDbWMzT0hkQlVsbEZRMEYzUjJOSVZtbGlSMnhxVFVaM1IwTnBjMGRCVVZGQ1p6YzRkMEZTWjBWVVozaE5ZMjFXZDJKNmNGcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnBPVlJaTWtaMVlraHJObU50Vm0xUGJrcHNXbTVOZG1GSFZtaGFTRTEyV1RJNWExcFlaM1prYWtsMVRWTXhkV05ITUhSalNFcDJaRzFXZFFwWlZ6VnFXbE14ZVZwWFRuWmtiVlo1WlZSRFFtbFJXVXRMZDFsQ1FrRklWMlZSU1VWQloxSTNRa2hyUVdSM1FqRkJUakE1VFVkeVIzaDRSWGxaZUd0bENraEtiRzVPZDB0cFUydzJORE5xZVhRdk5HVkxZMjlCZGt0bE5rOUJRVUZDYjBweFMzQjBXVUZCUVZGRVFVVlpkMUpCU1dkSWQybE5RU3RSYURWSGNFOEtjSGRuUjNBclprTXJTblZYVmxkdWJIZHNla0p1VEVoSVJYRlVhMGRtVVVOSlJXeDBhM0pRVjFFMWRGSTRkMWhXUkRGd0sxWTJlbkl6Vmtkc1RXZDZaUXBWZERKR2FGZFZlR0V4TTFOTlFXOUhRME54UjFOTk5EbENRVTFFUVRKblFVMUhWVU5OU0RSd1p6ZHhlVkozUTBOMFNXaDVSbmw1UkVKaVdqSjZPR1ozQ21RMFQyaDVURFJZTjJKS2QwMXZOVzVFTUdkclVDczRkWGhRWVROM00yMUZZMVZYWm1sblNYaEJUa2RIVWtaTE9FbHVTRVJXUlRaYWVWRkNibk54UVZFS0x5dGFMellyZVU4d04zbzFRVzlzV0Vka1FXdDZjSEF6V0VKUFIzbzRXREJEZEVSRWJrMVFha05CUFQwS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9XX19" + } + ], + "timestampVerificationData": {} + }, + "dsseEnvelope": { + "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoicGtnOm5wbS8lNDBzY2FubHkvYmVuY2htYXJrQDIuMS4wIiwiZGlnZXN0Ijp7InNoYTUxMiI6IjZlMjYyYzFmNzBkZjhjYzAzZDMwZjhkMDk2ZDdjZjNmY2ZiYWYzOTJkNWU5ZTdmZWE0YWMzZGE0ZDNkMDk4Zjk1YzlmMDY0YjZhNzVjNzM4YjQ5ZTk4NGI0MTc2YjFlMmI3YTBkNjQ4ZTg3N2JjNjI2MTk2MmJjYmVjNjBkNWNmIn19XSwicHJlZGljYXRlVHlwZSI6Imh0dHBzOi8vc2xzYS5kZXYvcHJvdmVuYW5jZS92MSIsInByZWRpY2F0ZSI6eyJidWlsZERlZmluaXRpb24iOnsiYnVpbGRUeXBlIjoiaHR0cHM6Ly9zbHNhLWZyYW1ld29yay5naXRodWIuaW8vZ2l0aHViLWFjdGlvbnMtYnVpbGR0eXBlcy93b3JrZmxvdy92MSIsImV4dGVybmFsUGFyYW1ldGVycyI6eyJ3b3JrZmxvdyI6eyJyZWYiOiJyZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkiLCJyZXBvc2l0b3J5IjoiaHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seSIsInBhdGgiOiIuZ2l0aHViL3dvcmtmbG93cy92Mi4xLWFydGlmYWN0LXF1YWxpZmljYXRpb24ueW1sIn0sInNvdXJjZV9jb21taXQiOiI2YjAxN2I1M2E0NDA0ZjRmZWFiNzc2YWMxMTFiMGVhOWRhY2YyNzM0In0sImludGVybmFsUGFyYW1ldGVycyI6eyJnaXRodWIiOnsiZXZlbnRfbmFtZSI6IndvcmtmbG93X2Rpc3BhdGNoIiwicmVwb3NpdG9yeV9pZCI6IjExNTYzNDI2NTMiLCJyZXBvc2l0b3J5X293bmVyX2lkIjoiMjI0MzcwODk4In19LCJyZXNvbHZlZERlcGVuZGVuY2llcyI6W3sidXJpIjoiZ2l0K2h0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHlAcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5IiwiZGlnZXN0Ijp7ImdpdENvbW1pdCI6ImUyMmQxMDAxNjM1NjUxNjRlMjE0OWY5OWFiNTRkMTFhNjExMTkzMmIifX0seyJ1cmkiOiJnaXQraHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seUA2YjAxN2I1M2E0NDA0ZjRmZWFiNzc2YWMxMTFiMGVhOWRhY2YyNzM0IiwiZGlnZXN0Ijp7ImdpdENvbW1pdCI6IjZiMDE3YjUzYTQ0MDRmNGZlYWI3NzZhYzExMWIwZWE5ZGFjZjI3MzQifX1dfSwicnVuRGV0YWlscyI6eyJidWlsZGVyIjp7ImlkIjoiaHR0cHM6Ly9naXRodWIuY29tL2FjdGlvbnMvcnVubmVyL2dpdGh1Yi1ob3N0ZWQifSwibWV0YWRhdGEiOnsiaW52b2NhdGlvbklkIjoiaHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seS9hY3Rpb25zL3J1bnMvMzQ3NTQ2NzM1NDcvYXR0ZW1wdHMvMSJ9fX19", + "payloadType": "application/vnd.in-toto+json", + "signatures": [ + { + "sig": "MEUCIQDpTi0X9rCq/B+0AG253Sv9VnQsIfD6S3nVnyQnms7GCwIgNXkR+y8T522cqxL8+3szsgqMwXq0puktgehAvFZwF9E=" + } + ] + } +} diff --git a/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-browser-2.1.0.tgz.sigstore.json b/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-browser-2.1.0.tgz.sigstore.json new file mode 100644 index 0000000..978a3fb --- /dev/null +++ b/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-browser-2.1.0.tgz.sigstore.json @@ -0,0 +1,58 @@ +{ + "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", + "verificationMaterial": { + "certificate": { + "rawBytes": "MIIILTCCB7KgAwIBAgIUdXYrPukudljNe7Uhk/+2I2E2fBQwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTEzMTEzMjU0WhcNMjYwOTEzMTE0MjU0WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEV0BdfMDuRF1z28/9MbM1cS4vkM1mJEltusF3D1L7oO58FBpzy9pDamMr3/eiPzPPw+2XXThT5ditwo1mEC1O0qOCBtEwggbNMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUgfCwANpTBr7aoFyuRtR698Nd91IwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wgZkGA1UdEQEB/wSBjjCBi4aBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAfBgorBgEEAYO/MAECBBF3b3JrZmxvd19kaXNwYXRjaDA2BgorBgEEAYO/MAEDBChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCkGCisGAQQBg78wAQQEG3YyLjEgQXJ0aWZhY3QgUXVhbGlmaWNhdGlvbjAjBgorBgEEAYO/MAEFBBVZYW5nanVuamllLUxpbi9TY2FubHkwOwYKKwYBBAGDvzABBgQtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTCBmgYKKwYBBAGDvzABCQSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABCgQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMB0GCisGAQQBg78wAQsEDwwNZ2l0aHViLWhvc3RlZDA4BgorBgEEAYO/MAEMBCoMKGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkwOAYKKwYBBAGDvzABDQQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMD0GCisGAQQBg78wAQ4ELwwtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MBoGCisGAQQBg78wAQ8EDAwKMTE1NjM0MjY1MzAxBgorBgEEAYO/MAEQBCMMIWh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbjAZBgorBgEEAYO/MAERBAsMCTIyNDM3MDg5ODCBmgYKKwYBBAGDvzABEgSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABEwQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCEGCisGAQQBg78wARQEEwwRd29ya2Zsb3dfZGlzcGF0Y2gwXAYKKwYBBAGDvzABFQRODExodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5L2FjdGlvbnMvcnVucy8zNDc1NDY3MzU0Ny9hdHRlbXB0cy8xMBYGCisGAQQBg78wARYECAwGcHVibGljMFwGCisGAQQBg78wARgETgxMcmVwbzpZYW5nanVuamllLUxpbi9TY2FubHk6cmVmOnJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeTCBigYKKwYBBAHWeQIEAgR8BHoAeAB2AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABoJqKrKsAAAQDAEcwRQIhAM+pbPMzN8ZUzvf0RpsS5KMI9ru3nbSjV0uPbJRVDtoIAiBeoeYp2kklJy07bJRAPuDfA8h+t7BIwOa/dzfyX4EMBzAKBggqhkjOPQQDAwNpADBmAjEAu4ZC5R0aRkk7YzfdBs2Vd7KB9Nie9Uqw5YzWKnmSN2hqVsiOwzPVs8FzQw2HEofvAjEA+jxSfrDstnaLjFI4oZKRb/xBw98AIGxyYoPOjxRrcK9ur+Tzd7R2cyMBaGXLyhiF" + }, + "tlogEntries": [ + { + "logIndex": "2817434259", + "logId": { + "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=" + }, + "kindVersion": { + "kind": "dsse", + "version": "0.0.1" + }, + "integratedTime": "1789299174", + "inclusionPromise": { + "signedEntryTimestamp": "MEUCIQDFOQjXidXB6Zz6OjDf93FRuHE4XVCX32X3Nwm1u3YmSwIgRpHrFVpsIHBVTOXif1zJZw0dV3uA23BrNjspghET5MI=" + }, + "inclusionProof": { + "logIndex": "2695529997", + "rootHash": "FtkbQTaK27P0XhrBpH0msC74o/fhzMPrsaAf+Ot6obs=", + "treeSize": "2695530000", + "hashes": [ + "wcosUxfFVQ3yuyKc+djP9+cSmhCWGQcFiKA++utVNtA=", + "8DWYMcV7JTBuTj7YT5Nx4c4Yt/SNywpZsgFofAIOZ1M=", + "LdqGn8znuDLSIezWLc7Zz+3tyYvIlSMjIEQ/sQHZqu8=", + "aR+NmIyKwDkbJiUU45/8LjUWcdzNMzW5H/ubF9XEvCk=", + "bn0+2E2n+wV44E6BldBG+EntOjWNO2XgM3PgmMwKIT0=", + "ys1AmRgOQ1cBbTrHqVAy0aCMdqJ6C/QxHXAD9GZhxmA=", + "99PoJTYgPWevn9oVlADbWdRGR90JL8Fx/FV0T06o0IA=", + "LQtwekqXPoO3KgXYEfRsV0WYK6Gk0PLLePxJWdZgThQ=", + "qOZd1StyLttRdZ9ojwet4/yO1QqFuSN2bQKQaTXLrkY=", + "uXYCZMF7lS28YUWZqw7VfMV5vdtFS6j7/bavDJtBebk=", + "S39m2eTD1rqRuAMs4r+sGsYIwW0BlTWuysWTKJ8RKVk=", + "qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=", + "xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY=" + ], + "checkpoint": { + "envelope": "rekor.sigstore.dev - 1193050959916656506\n2695530000\nFtkbQTaK27P0XhrBpH0msC74o/fhzMPrsaAf+Ot6obs=\n\n— rekor.sigstore.dev wNI9ajBEAiAaSLkb21ejWTDR8q0avE4ihoHc24Tad4sH0ie7SIL5TAIgeO967pHogjWY4DAiBW8UgJj0HbECb2YRXOt0CbmyoWc=\n" + } + }, + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiOGI2ZjdlNDc2OGQxM2RiOWQ2ZmQ1N2VlYzY3ZjA1NzJjM2NiZDE3NmJjY2ZlYzEzYjAwMzFmYzdjMjg1NTE1YyJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImM3OWI4NThhMjAxYmM3NjQzOGIxYTZmMWQ1YjQzMDNkNWY2ZGNhMzY2MTBhNjkwOTQwZWZiODBlZDM0MTQxOWMifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVVQ0lRQ0hzdXEvcC9XVzBOQlF4VTl5RnRKcG8rNVp0a0ZUMjU1UTdJcVpwVlNPN3dJZ09qbzlmNnhOU1BLcDIxTTRTT2dQaWNGdzFudUVQaUVjVGkzcHpSUXE4Mmc9IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VsTVZFTkRRamRMWjBGM1NVSkJaMGxWWkZoWmNsQjFhM1ZrYkdwT1pUZFZhR3N2S3pKSk1rVXlaa0pSZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwOVVSWHBOVkVWNlRXcFZNRmRvWTA1TmFsbDNUMVJGZWsxVVJUQk5hbFV3VjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVldNRUprWmsxRWRWSkdNWG95T0M4NVRXSk5NV05UTkhaclRURnRTa1ZzZEhWelJqTUtSREZNTjI5UE5UaEdRbkI2ZVRsd1JHRnRUWEl6TDJWcFVIcFFVSGNyTWxoWVZHaFVOV1JwZEhkdk1XMUZRekZQTUhGUFEwSjBSWGRuWjJKT1RVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVm5aa04zQ2tGT2NGUkNjamRoYjBaNWRWSjBValk1T0U1a09URkpkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMmRhYTBkQk1WVmtSVkZGUWk5M1UwSnFha05DYVRSaFFtbEhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RRcGhiV3hzVEZWNGNHSnBPVlJaTWtaMVlraHJka3h0WkhCa1IyZ3hXV2s1TTJJelNuSmFiWGgyWkROTmRtUnFTWFZOVXpGb1kyNVNjRnB0Um1wa1F6RjRDbVJYUm5OaFYxcHdXVEpHTUdGWE9YVk1ibXgwWWtWQ2VWcFhXbnBNTW1oc1dWZFNla3d5VG5aYVIxWTBURE5aZVV4cVJYUmlia0owVEZoQ2VXSXpXbXdLWW0xR2RWa3lWWFJqYlZacVlqTmFiR051YTNkUFVWbExTM2RaUWtKQlIwUjJla0ZDUVZGUmNtRklVakJqU0UwMlRIazVNR0l5ZEd4aWFUVm9XVE5TY0FwaU1qVjZURzFrY0dSSGFERlpibFo2V2xoS2FtSXlOVEJhVnpVd1RHMU9kbUpVUVdaQ1oyOXlRbWRGUlVGWlR5OU5RVVZEUWtKR00ySXpTbkphYlhoMkNtUXhPV3RoV0U1M1dWaFNhbUZFUVRKQ1oyOXlRbWRGUlVGWlR5OU5RVVZFUWtOb2JFMXFTbXROVkVGM1RWUlplazVVV1RGTlZGa3dXbFJKZUU1RWJHMEtUMVJzYUZscVZUQmFSRVY0V1ZSWmVFMVVSVFZOZWtwcFRVTnJSME5wYzBkQlVWRkNaemM0ZDBGUlVVVkhNMWw1VEdwRloxRllTakJoVjFwb1dUTlJad3BWV0Zab1lrZHNiV0ZYVG1oa1IyeDJZbXBCYWtKbmIzSkNaMFZGUVZsUEwwMUJSVVpDUWxaYVdWYzFibUZ1Vm5WaGJXeHNURlY0Y0dKcE9WUlpNa1oxQ21KSWEzZFBkMWxMUzNkWlFrSkJSMFIyZWtGQ1FtZFJkR050Vm0xamVUbHZXbGRHYTJONU9XcGlNbEpzWlVNNU1rMXBOSGhNVnpWM1lsTXhkMk50T1RJS1dsYzFhR0p0VG14TVdFcHNXVEk1TWxwWVNqVk5SSE5IUTJselIwRlJVVUpuTnpoM1FWRm5SVXhSZDNKaFNGSXdZMGhOTmt4NU9UQmlNblJzWW1rMWFBcFpNMUp3WWpJMWVreHRaSEJrUjJneFdXNVdlbHBZU21waU1qVXdXbGMxTUV4dFRuWmlWRU5DYldkWlMwdDNXVUpDUVVkRWRucEJRa05SVTBKcGQzbENDbWxIYURCa1NFSjZUMms0ZGxveWJEQmhTRlpwVEcxT2RtSlRPVnBaVnpWdVlXNVdkV0Z0Ykd4TVZYaHdZbWs1VkZreVJuVmlTR3QyVEcxa2NHUkhhREVLV1drNU0ySXpTbkphYlhoMlpETk5kbVJxU1hWTlV6Rm9ZMjVTY0ZwdFJtcGtRekY0WkZkR2MyRlhXbkJaTWtZd1lWYzVkVXh1YkhSaVJVSjVXbGRhZWdwTU1taHNXVmRTZWt3eVRuWmFSMVkwVEROWmVVeHFSWFJpYmtKMFRGaENlV0l6V214aWJVWjFXVEpWZEdOdFZtcGlNMXBzWTI1cmQwOUJXVXRMZDFsQ0NrSkJSMFIyZWtGQ1EyZFJjVVJEYUd4TmFrcHJUVlJCZDAxVVdYcE9WRmt4VFZSWk1GcFVTWGhPUkd4dFQxUnNhRmxxVlRCYVJFVjRXVlJaZUUxVVJUVUtUWHBLYVUxQ01FZERhWE5IUVZGUlFtYzNPSGRCVVhORlJIZDNUbG95YkRCaFNGWnBURmRvZG1NelVteGFSRUUwUW1kdmNrSm5SVVZCV1U4dlRVRkZUUXBDUTI5TlMwZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNVdsbFhOVzVoYmxaMVlXMXNiRXhWZUhCaWFUbFVXVEpHZFdKSWEzZFBRVmxMQ2t0M1dVSkNRVWRFZG5wQlFrUlJVWEZFUTJoc1RXcEthMDFVUVhkTlZGbDZUbFJaTVUxVVdUQmFWRWw0VGtSc2JVOVViR2haYWxVd1drUkZlRmxVV1hnS1RWUkZOVTE2U21sTlJEQkhRMmx6UjBGUlVVSm5OemgzUVZFMFJVeDNkM1JqYlZadFkzazViMXBYUm10amVUbHFZakpTYkdWRE9USk5hVFI0VEZjMWR3cGlVekYzWTIwNU1scFhOV2hpYlU1c1RGaEtiRmt5T1RKYVdFbzFUVUp2UjBOcGMwZEJVVkZDWnpjNGQwRlJPRVZFUVhkTFRWUkZNVTVxVFRCTmFsa3hDazE2UVhoQ1oyOXlRbWRGUlVGWlR5OU5RVVZSUWtOTlRVbFhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnFRVnBDWjI5eVFtZEZSVUZaVHk5TlFVVlNRa0Z6VFVOVVNYbE9SRTB6VFVSbk5VOUVRMEp0WjFsTFMzZFpRa0pCUjBSMmVrRkNSV2RUUWdwcGQzbENhVWRvTUdSSVFucFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVXbGxYTlc1aGJsWjFZVzFzYkV4VmVIQmlhVGxVV1RKR2RXSklhM1pNYldSd0NtUkhhREZaYVRrellqTktjbHB0ZUhaa00wMTJaR3BKZFUxVE1XaGpibEp3V20xR2FtUkRNWGhrVjBaellWZGFjRmt5UmpCaFZ6bDFURzVzZEdKRlFua0tXbGRhZWt3eWFHeFpWMUo2VERKT2RscEhWalJNTTFsNVRHcEZkR0p1UW5STVdFSjVZak5hYkdKdFJuVlpNbFYwWTIxV2FtSXpXbXhqYm10M1QwRlpTd3BMZDFsQ1FrRkhSSFo2UVVKRmQxRnhSRU5vYkUxcVNtdE5WRUYzVFZSWmVrNVVXVEZOVkZrd1dsUkplRTVFYkcxUFZHeG9XV3BWTUZwRVJYaFpWRmw0Q2sxVVJUVk5la3BwVFVORlIwTnBjMGRCVVZGQ1p6YzRkMEZTVVVWRmQzZFNaREk1ZVdFeVduTmlNMlJtV2tkc2VtTkhSakJaTW1kM1dFRlpTMHQzV1VJS1FrRkhSSFo2UVVKR1VWSlBSRVY0YjJSSVVuZGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbGRYUm5WYU1uQXhZbTF3Y0ZwVE1VMWhWelIyVlRKT2FBcGliWGcxVERKR2FtUkhiSFppYmsxMlkyNVdkV041T0hwT1JHTXhUa1JaTTAxNlZUQk9lVGxvWkVoU2JHSllRakJqZVRoNFRVSlpSME5wYzBkQlVWRkNDbWMzT0hkQlVsbEZRMEYzUjJOSVZtbGlSMnhxVFVaM1IwTnBjMGRCVVZGQ1p6YzRkMEZTWjBWVVozaE5ZMjFXZDJKNmNGcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnBPVlJaTWtaMVlraHJObU50Vm0xUGJrcHNXbTVOZG1GSFZtaGFTRTEyV1RJNWExcFlaM1prYWtsMVRWTXhkV05ITUhSalNFcDJaRzFXZFFwWlZ6VnFXbE14ZVZwWFRuWmtiVlo1WlZSRFFtbG5XVXRMZDFsQ1FrRklWMlZSU1VWQloxSTRRa2h2UVdWQlFqSkJUakE1VFVkeVIzaDRSWGxaZUd0bENraEtiRzVPZDB0cFUydzJORE5xZVhRdk5HVkxZMjlCZGt0bE5rOUJRVUZDYjBweFMzSkxjMEZCUVZGRVFVVmpkMUpSU1doQlRTdHdZbEJOZWs0NFdsVUtlblptTUZKd2MxTTFTMDFKT1hKMU0yNWlVMnBXTUhWUVlrcFNWa1IwYjBsQmFVSmxiMlZaY0RKcmEyeEtlVEEzWWtwU1FWQjFSR1pCT0dncmREZENTUXAzVDJFdlpIcG1lVmcwUlUxQ2VrRkxRbWRuY1docmFrOVFVVkZFUVhkT2NFRkVRbTFCYWtWQmRUUmFRelZTTUdGU2EyczNXWHBtWkVKek1sWmtOMHRDQ2psT2FXVTVWWEYzTlZsNlYwdHViVk5PTW1oeFZuTnBUM2Q2VUZaek9FWjZVWGN5U0VWdlpuWkJha1ZCSzJwNFUyWnlSSE4wYm1GTWFrWkpORzlhUzFJS1lpOTRRbmM1T0VGSlIzaDVXVzlRVDJwNFVuSmpTemwxY2l0VWVtUTNVakpqZVUxQ1lVZFlUSGxvYVVZS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9XX19" + } + ], + "timestampVerificationData": {} + }, + "dsseEnvelope": { + "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoicGtnOm5wbS8lNDBzY2FubHkvYnJvd3NlckAyLjEuMCIsImRpZ2VzdCI6eyJzaGE1MTIiOiIwN2ZmYTIwN2FhMmE4MjYwOWIwZTgwOGFlOTIyMWMzYzc3MzU5MDQwNmIzZmUxMWRkNDVlNGNmOTg0MGZjMTYyMTcwZTQyZWZkYThkODJlZjcyYjM5YjlmMzMzMDhlODRkYjgxOGEwMjM5ZTU2M2IzN2M2NmQwMDhjNzY4Y2YzZSJ9fV0sInByZWRpY2F0ZVR5cGUiOiJodHRwczovL3Nsc2EuZGV2L3Byb3ZlbmFuY2UvdjEiLCJwcmVkaWNhdGUiOnsiYnVpbGREZWZpbml0aW9uIjp7ImJ1aWxkVHlwZSI6Imh0dHBzOi8vc2xzYS1mcmFtZXdvcmsuZ2l0aHViLmlvL2dpdGh1Yi1hY3Rpb25zLWJ1aWxkdHlwZXMvd29ya2Zsb3cvdjEiLCJleHRlcm5hbFBhcmFtZXRlcnMiOnsid29ya2Zsb3ciOnsicmVmIjoicmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5IiwicmVwb3NpdG9yeSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkiLCJwYXRoIjoiLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbCJ9LCJzb3VyY2VfY29tbWl0IjoiNmIwMTdiNTNhNDQwNGY0ZmVhYjc3NmFjMTExYjBlYTlkYWNmMjczNCJ9LCJpbnRlcm5hbFBhcmFtZXRlcnMiOnsiZ2l0aHViIjp7ImV2ZW50X25hbWUiOiJ3b3JrZmxvd19kaXNwYXRjaCIsInJlcG9zaXRvcnlfaWQiOiIxMTU2MzQyNjUzIiwicmVwb3NpdG9yeV9vd25lcl9pZCI6IjIyNDM3MDg5OCJ9fSwicmVzb2x2ZWREZXBlbmRlbmNpZXMiOlt7InVyaSI6ImdpdCtodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5QHJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeSIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiJlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiIn19LHsidXJpIjoiZ2l0K2h0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHlANmIwMTdiNTNhNDQwNGY0ZmVhYjc3NmFjMTExYjBlYTlkYWNmMjczNCIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiI2YjAxN2I1M2E0NDA0ZjRmZWFiNzc2YWMxMTFiMGVhOWRhY2YyNzM0In19XX0sInJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY3Rpb25zL3J1bm5lci9naXRodWItaG9zdGVkIn0sIm1ldGFkYXRhIjp7Imludm9jYXRpb25JZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvYWN0aW9ucy9ydW5zLzM0NzU0NjczNTQ3L2F0dGVtcHRzLzEifX19fQ==", + "payloadType": "application/vnd.in-toto+json", + "signatures": [ + { + "sig": "MEUCIQCHsuq/p/WW0NBQxU9yFtJpo+5ZtkFT255Q7IqZpVSO7wIgOjo9f6xNSPKp21M4SOgPicFw1nuEPiEcTi3pzRQq82g=" + } + ] + } +} diff --git a/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-core-2.1.0.tgz.sigstore.json b/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-core-2.1.0.tgz.sigstore.json new file mode 100644 index 0000000..97ffc93 --- /dev/null +++ b/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-core-2.1.0.tgz.sigstore.json @@ -0,0 +1,60 @@ +{ + "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", + "verificationMaterial": { + "certificate": { + "rawBytes": "MIIILDCCB7KgAwIBAgIUSIy/EB7iEspRSXkFT9jy+rhOQCQwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTEzMTEzMjU1WhcNMjYwOTEzMTE0MjU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE+0n+AzIE7LJmtwmRsW66Nd/2sZwjoIVbAgxCesvn6uLN0ogPKL6iXLEFPmiHRmaJbyeXyIKeWiYxADSBK9ijPaOCBtEwggbNMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUSh9EMTSrbp7K2YobgtTtkOYI2ZcwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wgZkGA1UdEQEB/wSBjjCBi4aBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAfBgorBgEEAYO/MAECBBF3b3JrZmxvd19kaXNwYXRjaDA2BgorBgEEAYO/MAEDBChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCkGCisGAQQBg78wAQQEG3YyLjEgQXJ0aWZhY3QgUXVhbGlmaWNhdGlvbjAjBgorBgEEAYO/MAEFBBVZYW5nanVuamllLUxpbi9TY2FubHkwOwYKKwYBBAGDvzABBgQtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTCBmgYKKwYBBAGDvzABCQSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABCgQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMB0GCisGAQQBg78wAQsEDwwNZ2l0aHViLWhvc3RlZDA4BgorBgEEAYO/MAEMBCoMKGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkwOAYKKwYBBAGDvzABDQQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMD0GCisGAQQBg78wAQ4ELwwtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MBoGCisGAQQBg78wAQ8EDAwKMTE1NjM0MjY1MzAxBgorBgEEAYO/MAEQBCMMIWh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbjAZBgorBgEEAYO/MAERBAsMCTIyNDM3MDg5ODCBmgYKKwYBBAGDvzABEgSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABEwQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCEGCisGAQQBg78wARQEEwwRd29ya2Zsb3dfZGlzcGF0Y2gwXAYKKwYBBAGDvzABFQRODExodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5L2FjdGlvbnMvcnVucy8zNDc1NDY3MzU0Ny9hdHRlbXB0cy8xMBYGCisGAQQBg78wARYECAwGcHVibGljMFwGCisGAQQBg78wARgETgxMcmVwbzpZYW5nanVuamllLUxpbi9TY2FubHk6cmVmOnJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeTCBigYKKwYBBAHWeQIEAgR8BHoAeAB2AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABoJqKsUIAAAQDAEcwRQIgNqq+xIha6J+DNNuGWGHoTDyNHPm4NgyhitIkN2h2av0CIQDsu+JKqn2vMTB1VVEhiyc44APahE+/rG6DeagYOitxJTAKBggqhkjOPQQDAwNoADBlAjAHkcuZZ/A02sxdEQEIcrvVxL1EUCxO5tZS+nfy+V2eG9Y5QGAydpAg+Se8HLwzsLICMQDUIhbGJpa8Qjs5bkSXvXpolaJ5kaCqHWlL55afhXgBtIcYkf05fGpxQ/Dv8WnUJUs=" + }, + "tlogEntries": [ + { + "logIndex": "2817434387", + "logId": { + "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=" + }, + "kindVersion": { + "kind": "dsse", + "version": "0.0.1" + }, + "integratedTime": "1789299175", + "inclusionPromise": { + "signedEntryTimestamp": "MEQCIEhXcmgmXGufXLxXHsYQ8h7j7ODxbmqC+AIOb0lDU3+eAiAoOUJznFps1eoodbm/UfSbAJVG1MBcOZ4OVAvDeZPkKA==" + }, + "inclusionProof": { + "logIndex": "2695530125", + "rootHash": "DDIDvk/sZBM6w8KaxfSiEI9BzFDkN+MuuSbMdTLwpow=", + "treeSize": "2695530131", + "hashes": [ + "eDFXMaY3QhvYSsLMhhSe6p2n1zp18NXCRuNRHlHIvGg=", + "h78ef/TuU/kFT7AS+sgP1NiLDb/gtqT8heqtiL+RhIg=", + "pcsucyUG1RRLosgfN/Hau+4y70LhAyRTdBoHxtZm66A=", + "ofVeprICZ1aI5RavRFDpoHUutjOj0cAEW5qptHGwB0U=", + "uRN9VpkdZdvt6VOyjVU0k8S6O7ybbSgLG87Qy787ftk=", + "09xWaDdKLwNFYlJwBzktGgVJASEYxGpxYrAGR/nlZrg=", + "bn0+2E2n+wV44E6BldBG+EntOjWNO2XgM3PgmMwKIT0=", + "ys1AmRgOQ1cBbTrHqVAy0aCMdqJ6C/QxHXAD9GZhxmA=", + "99PoJTYgPWevn9oVlADbWdRGR90JL8Fx/FV0T06o0IA=", + "LQtwekqXPoO3KgXYEfRsV0WYK6Gk0PLLePxJWdZgThQ=", + "qOZd1StyLttRdZ9ojwet4/yO1QqFuSN2bQKQaTXLrkY=", + "uXYCZMF7lS28YUWZqw7VfMV5vdtFS6j7/bavDJtBebk=", + "S39m2eTD1rqRuAMs4r+sGsYIwW0BlTWuysWTKJ8RKVk=", + "qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=", + "xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY=" + ], + "checkpoint": { + "envelope": "rekor.sigstore.dev - 1193050959916656506\n2695530131\nDDIDvk/sZBM6w8KaxfSiEI9BzFDkN+MuuSbMdTLwpow=\n\n— rekor.sigstore.dev wNI9ajBGAiEA/gfjFDlIKfvUQ8c6IcrWfTAnuQaRVA+p3I1tcsRhNMkCIQDbCo+WRC4hi6HLyMWsgr2WyAuzPlbMP2bG3a2lc8vnZA==\n" + } + }, + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiODRiZTExNTY1ZDlmMGVjODkyMmE3NmIzZDkzYjYzNTM3NDk2ZWViMDVmZWVhMWVkYjEyZTM5MjRmMjJjMzMzMCJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImNiYjQyMzcxYjAzYjIxYzM3NWVjZmI2OWUwNTZkYzFkZmNlOGIzMTYxZWJiYWMzMWZhOGUzMTdkYzhiMmNiMTEifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVVQ0lRQ0dEWmtxRG1ySkRWdkYrdWdEdWxMVUtWR1pNVE8xNjlLNCtqMGxRRkJzaVFJZ0UvNjVEbVZvR3dQaVZlVnBZWHIzUXVINFI4S09aYjQreXRiaDVkc1RJRm89IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VsTVJFTkRRamRMWjBGM1NVSkJaMGxWVTBsNUwwVkNOMmxGYzNCU1UxaHJSbFE1YW5rcmNtaFBVVU5SZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwOVVSWHBOVkVWNlRXcFZNVmRvWTA1TmFsbDNUMVJGZWsxVVJUQk5hbFV4VjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVXJNRzRyUVhwSlJUZE1TbTEwZDIxU2MxYzJOazVrTHpKelduZHFiMGxXWWtGbmVFTUtaWE4yYmpaMVRFNHdiMmRRUzB3MmFWaE1SVVpRYldsSVVtMWhTbUo1WlZoNVNVdGxWMmxaZUVGRVUwSkxPV2xxVUdGUFEwSjBSWGRuWjJKT1RVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVlRhRGxGQ2sxVVUzSmljRGRMTWxsdlltZDBWSFJyVDFsSk1scGpkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMmRhYTBkQk1WVmtSVkZGUWk5M1UwSnFha05DYVRSaFFtbEhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RRcGhiV3hzVEZWNGNHSnBPVlJaTWtaMVlraHJka3h0WkhCa1IyZ3hXV2s1TTJJelNuSmFiWGgyWkROTmRtUnFTWFZOVXpGb1kyNVNjRnB0Um1wa1F6RjRDbVJYUm5OaFYxcHdXVEpHTUdGWE9YVk1ibXgwWWtWQ2VWcFhXbnBNTW1oc1dWZFNla3d5VG5aYVIxWTBURE5aZVV4cVJYUmlia0owVEZoQ2VXSXpXbXdLWW0xR2RWa3lWWFJqYlZacVlqTmFiR051YTNkUFVWbExTM2RaUWtKQlIwUjJla0ZDUVZGUmNtRklVakJqU0UwMlRIazVNR0l5ZEd4aWFUVm9XVE5TY0FwaU1qVjZURzFrY0dSSGFERlpibFo2V2xoS2FtSXlOVEJhVnpVd1RHMU9kbUpVUVdaQ1oyOXlRbWRGUlVGWlR5OU5RVVZEUWtKR00ySXpTbkphYlhoMkNtUXhPV3RoV0U1M1dWaFNhbUZFUVRKQ1oyOXlRbWRGUlVGWlR5OU5RVVZFUWtOb2JFMXFTbXROVkVGM1RWUlplazVVV1RGTlZGa3dXbFJKZUU1RWJHMEtUMVJzYUZscVZUQmFSRVY0V1ZSWmVFMVVSVFZOZWtwcFRVTnJSME5wYzBkQlVWRkNaemM0ZDBGUlVVVkhNMWw1VEdwRloxRllTakJoVjFwb1dUTlJad3BWV0Zab1lrZHNiV0ZYVG1oa1IyeDJZbXBCYWtKbmIzSkNaMFZGUVZsUEwwMUJSVVpDUWxaYVdWYzFibUZ1Vm5WaGJXeHNURlY0Y0dKcE9WUlpNa1oxQ21KSWEzZFBkMWxMUzNkWlFrSkJSMFIyZWtGQ1FtZFJkR050Vm0xamVUbHZXbGRHYTJONU9XcGlNbEpzWlVNNU1rMXBOSGhNVnpWM1lsTXhkMk50T1RJS1dsYzFhR0p0VG14TVdFcHNXVEk1TWxwWVNqVk5SSE5IUTJselIwRlJVVUpuTnpoM1FWRm5SVXhSZDNKaFNGSXdZMGhOTmt4NU9UQmlNblJzWW1rMWFBcFpNMUp3WWpJMWVreHRaSEJrUjJneFdXNVdlbHBZU21waU1qVXdXbGMxTUV4dFRuWmlWRU5DYldkWlMwdDNXVUpDUVVkRWRucEJRa05SVTBKcGQzbENDbWxIYURCa1NFSjZUMms0ZGxveWJEQmhTRlpwVEcxT2RtSlRPVnBaVnpWdVlXNVdkV0Z0Ykd4TVZYaHdZbWs1VkZreVJuVmlTR3QyVEcxa2NHUkhhREVLV1drNU0ySXpTbkphYlhoMlpETk5kbVJxU1hWTlV6Rm9ZMjVTY0ZwdFJtcGtRekY0WkZkR2MyRlhXbkJaTWtZd1lWYzVkVXh1YkhSaVJVSjVXbGRhZWdwTU1taHNXVmRTZWt3eVRuWmFSMVkwVEROWmVVeHFSWFJpYmtKMFRGaENlV0l6V214aWJVWjFXVEpWZEdOdFZtcGlNMXBzWTI1cmQwOUJXVXRMZDFsQ0NrSkJSMFIyZWtGQ1EyZFJjVVJEYUd4TmFrcHJUVlJCZDAxVVdYcE9WRmt4VFZSWk1GcFVTWGhPUkd4dFQxUnNhRmxxVlRCYVJFVjRXVlJaZUUxVVJUVUtUWHBLYVUxQ01FZERhWE5IUVZGUlFtYzNPSGRCVVhORlJIZDNUbG95YkRCaFNGWnBURmRvZG1NelVteGFSRUUwUW1kdmNrSm5SVVZCV1U4dlRVRkZUUXBDUTI5TlMwZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNVdsbFhOVzVoYmxaMVlXMXNiRXhWZUhCaWFUbFVXVEpHZFdKSWEzZFBRVmxMQ2t0M1dVSkNRVWRFZG5wQlFrUlJVWEZFUTJoc1RXcEthMDFVUVhkTlZGbDZUbFJaTVUxVVdUQmFWRWw0VGtSc2JVOVViR2haYWxVd1drUkZlRmxVV1hnS1RWUkZOVTE2U21sTlJEQkhRMmx6UjBGUlVVSm5OemgzUVZFMFJVeDNkM1JqYlZadFkzazViMXBYUm10amVUbHFZakpTYkdWRE9USk5hVFI0VEZjMWR3cGlVekYzWTIwNU1scFhOV2hpYlU1c1RGaEtiRmt5T1RKYVdFbzFUVUp2UjBOcGMwZEJVVkZDWnpjNGQwRlJPRVZFUVhkTFRWUkZNVTVxVFRCTmFsa3hDazE2UVhoQ1oyOXlRbWRGUlVGWlR5OU5RVVZSUWtOTlRVbFhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnFRVnBDWjI5eVFtZEZSVUZaVHk5TlFVVlNRa0Z6VFVOVVNYbE9SRTB6VFVSbk5VOUVRMEp0WjFsTFMzZFpRa0pCUjBSMmVrRkNSV2RUUWdwcGQzbENhVWRvTUdSSVFucFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVXbGxYTlc1aGJsWjFZVzFzYkV4VmVIQmlhVGxVV1RKR2RXSklhM1pNYldSd0NtUkhhREZaYVRrellqTktjbHB0ZUhaa00wMTJaR3BKZFUxVE1XaGpibEp3V20xR2FtUkRNWGhrVjBaellWZGFjRmt5UmpCaFZ6bDFURzVzZEdKRlFua0tXbGRhZWt3eWFHeFpWMUo2VERKT2RscEhWalJNTTFsNVRHcEZkR0p1UW5STVdFSjVZak5hYkdKdFJuVlpNbFYwWTIxV2FtSXpXbXhqYm10M1QwRlpTd3BMZDFsQ1FrRkhSSFo2UVVKRmQxRnhSRU5vYkUxcVNtdE5WRUYzVFZSWmVrNVVXVEZOVkZrd1dsUkplRTVFYkcxUFZHeG9XV3BWTUZwRVJYaFpWRmw0Q2sxVVJUVk5la3BwVFVORlIwTnBjMGRCVVZGQ1p6YzRkMEZTVVVWRmQzZFNaREk1ZVdFeVduTmlNMlJtV2tkc2VtTkhSakJaTW1kM1dFRlpTMHQzV1VJS1FrRkhSSFo2UVVKR1VWSlBSRVY0YjJSSVVuZGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbGRYUm5WYU1uQXhZbTF3Y0ZwVE1VMWhWelIyVlRKT2FBcGliWGcxVERKR2FtUkhiSFppYmsxMlkyNVdkV041T0hwT1JHTXhUa1JaTTAxNlZUQk9lVGxvWkVoU2JHSllRakJqZVRoNFRVSlpSME5wYzBkQlVWRkNDbWMzT0hkQlVsbEZRMEYzUjJOSVZtbGlSMnhxVFVaM1IwTnBjMGRCVVZGQ1p6YzRkMEZTWjBWVVozaE5ZMjFXZDJKNmNGcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnBPVlJaTWtaMVlraHJObU50Vm0xUGJrcHNXbTVOZG1GSFZtaGFTRTEyV1RJNWExcFlaM1prYWtsMVRWTXhkV05ITUhSalNFcDJaRzFXZFFwWlZ6VnFXbE14ZVZwWFRuWmtiVlo1WlZSRFFtbG5XVXRMZDFsQ1FrRklWMlZSU1VWQloxSTRRa2h2UVdWQlFqSkJUakE1VFVkeVIzaDRSWGxaZUd0bENraEtiRzVPZDB0cFUydzJORE5xZVhRdk5HVkxZMjlCZGt0bE5rOUJRVUZDYjBweFMzTlZTVUZCUVZGRVFVVmpkMUpSU1dkT2NYRXJlRWxvWVRaS0swUUtUazUxUjFkSFNHOVVSSGxPU0ZCdE5FNW5lV2hwZEVsclRqSm9NbUYyTUVOSlVVUnpkU3RLUzNGdU1uWk5WRUl4VmxaRmFHbDVZelEwUVZCaGFFVXJMd3B5UnpaRVpXRm5XVTlwZEhoS1ZFRkxRbWRuY1docmFrOVFVVkZFUVhkT2IwRkVRbXhCYWtGSWEyTjFXbG92UVRBeWMzaGtSVkZGU1dOeWRsWjRUREZGQ2xWRGVFODFkRnBUSzI1bWVTdFdNbVZIT1ZrMVVVZEJlV1J3UVdjclUyVTRTRXgzZW5OTVNVTk5VVVJWU1doaVIwcHdZVGhSYW5NMVltdFRXSFpZY0c4S2JHRktOV3RoUTNGSVYyeE1OVFZoWm1oWVowSjBTV05aYTJZd05XWkhjSGhSTDBSMk9GZHVWVXBWY3owS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9XX19" + } + ], + "timestampVerificationData": {} + }, + "dsseEnvelope": { + "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoicGtnOm5wbS8lNDBzY2FubHkvY29yZUAyLjEuMCIsImRpZ2VzdCI6eyJzaGE1MTIiOiJjNmE4MTIzMTI4N2Y4YzliN2E3ZTMwNDgxZjY1ZDQ5NzQ5Njc3MWIwMDNkN2QzMTE0YTBiYzdjZGVjMDNiYWFjODAxYmFhNmMwOTU5NzhiOTFkNzdmNDhlYzQ4OWEwMzIwNTUwODI4OWNkZmNkZWU5YjcyYTVlOGVhZDEwZTJiZCJ9fV0sInByZWRpY2F0ZVR5cGUiOiJodHRwczovL3Nsc2EuZGV2L3Byb3ZlbmFuY2UvdjEiLCJwcmVkaWNhdGUiOnsiYnVpbGREZWZpbml0aW9uIjp7ImJ1aWxkVHlwZSI6Imh0dHBzOi8vc2xzYS1mcmFtZXdvcmsuZ2l0aHViLmlvL2dpdGh1Yi1hY3Rpb25zLWJ1aWxkdHlwZXMvd29ya2Zsb3cvdjEiLCJleHRlcm5hbFBhcmFtZXRlcnMiOnsid29ya2Zsb3ciOnsicmVmIjoicmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5IiwicmVwb3NpdG9yeSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkiLCJwYXRoIjoiLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbCJ9LCJzb3VyY2VfY29tbWl0IjoiNmIwMTdiNTNhNDQwNGY0ZmVhYjc3NmFjMTExYjBlYTlkYWNmMjczNCJ9LCJpbnRlcm5hbFBhcmFtZXRlcnMiOnsiZ2l0aHViIjp7ImV2ZW50X25hbWUiOiJ3b3JrZmxvd19kaXNwYXRjaCIsInJlcG9zaXRvcnlfaWQiOiIxMTU2MzQyNjUzIiwicmVwb3NpdG9yeV9vd25lcl9pZCI6IjIyNDM3MDg5OCJ9fSwicmVzb2x2ZWREZXBlbmRlbmNpZXMiOlt7InVyaSI6ImdpdCtodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5QHJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeSIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiJlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiIn19LHsidXJpIjoiZ2l0K2h0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHlANmIwMTdiNTNhNDQwNGY0ZmVhYjc3NmFjMTExYjBlYTlkYWNmMjczNCIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiI2YjAxN2I1M2E0NDA0ZjRmZWFiNzc2YWMxMTFiMGVhOWRhY2YyNzM0In19XX0sInJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY3Rpb25zL3J1bm5lci9naXRodWItaG9zdGVkIn0sIm1ldGFkYXRhIjp7Imludm9jYXRpb25JZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvYWN0aW9ucy9ydW5zLzM0NzU0NjczNTQ3L2F0dGVtcHRzLzEifX19fQ==", + "payloadType": "application/vnd.in-toto+json", + "signatures": [ + { + "sig": "MEUCIQCGDZkqDmrJDVvF+ugDulLUKVGZMTO169K4+j0lQFBsiQIgE/65DmVoGwPiVeVpYXr3QuH4R8KOZb4+ytbh5dsTIFo=" + } + ] + } +} diff --git a/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-engine-jsqr-2.1.0.tgz.sigstore.json b/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-engine-jsqr-2.1.0.tgz.sigstore.json new file mode 100644 index 0000000..18751d2 --- /dev/null +++ b/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-engine-jsqr-2.1.0.tgz.sigstore.json @@ -0,0 +1,60 @@ +{ + "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", + "verificationMaterial": { + "certificate": { + "rawBytes": "MIIIKzCCB7GgAwIBAgIUSeImzV1c/0TUr+ZKAFC5dOZIK5QwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTEzMTEzMzAyWhcNMjYwOTEzMTE0MzAyWjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEag8hf8hHGU38jV6FNE8F/NCuFte0qsRXOm6SNJG4OXyq08OH0rGZ7zWngUjZwkGdBQy1sVZ3VMzKnxeruWrMxKOCBtAwggbMMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUzlZRYnA9ym7shqJzvQMUEYGZNBwwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wgZkGA1UdEQEB/wSBjjCBi4aBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAfBgorBgEEAYO/MAECBBF3b3JrZmxvd19kaXNwYXRjaDA2BgorBgEEAYO/MAEDBChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCkGCisGAQQBg78wAQQEG3YyLjEgQXJ0aWZhY3QgUXVhbGlmaWNhdGlvbjAjBgorBgEEAYO/MAEFBBVZYW5nanVuamllLUxpbi9TY2FubHkwOwYKKwYBBAGDvzABBgQtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTCBmgYKKwYBBAGDvzABCQSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABCgQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMB0GCisGAQQBg78wAQsEDwwNZ2l0aHViLWhvc3RlZDA4BgorBgEEAYO/MAEMBCoMKGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkwOAYKKwYBBAGDvzABDQQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMD0GCisGAQQBg78wAQ4ELwwtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MBoGCisGAQQBg78wAQ8EDAwKMTE1NjM0MjY1MzAxBgorBgEEAYO/MAEQBCMMIWh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbjAZBgorBgEEAYO/MAERBAsMCTIyNDM3MDg5ODCBmgYKKwYBBAGDvzABEgSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABEwQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCEGCisGAQQBg78wARQEEwwRd29ya2Zsb3dfZGlzcGF0Y2gwXAYKKwYBBAGDvzABFQRODExodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5L2FjdGlvbnMvcnVucy8zNDc1NDY3MzU0Ny9hdHRlbXB0cy8xMBYGCisGAQQBg78wARYECAwGcHVibGljMFwGCisGAQQBg78wARgETgxMcmVwbzpZYW5nanVuamllLUxpbi9TY2FubHk6cmVmOnJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeTCBiQYKKwYBBAHWeQIEAgR7BHkAdwB1AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABoJqKygQAAAQDAEYwRAIgc2CBOlpbwrS49eFi2Ol7rEOsJL7OxNznKDxu+XjzkLoCIAi6eBXBWD+aS4YMImwhMf0MmXTAuYs2hw40B8v7/hfUMAoGCCqGSM49BAMDA2gAMGUCMCkhG9Nhd2kyPADMpQC7h9axWB4vZ4YRN83peogtarFvAn5NeWptTwfCtAQ54MFv9QIxAL5ARbJMsbi3R1hnUmEh1peBoCVqEMEuvJTcp43tOjDVe7olcJVwdm1MkSF7sG62Gg==" + }, + "tlogEntries": [ + { + "logIndex": "2817435309", + "logId": { + "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=" + }, + "kindVersion": { + "kind": "dsse", + "version": "0.0.1" + }, + "integratedTime": "1789299182", + "inclusionPromise": { + "signedEntryTimestamp": "MEQCIFlhC/9VAtT3UP7O1tBd6BNfh6SrdH3qOB9w4GMNPlo8AiBhjlMuI2ofKl/VZqnNhRRi/IbQbNtNRO5Bofz98NamrQ==" + }, + "inclusionProof": { + "logIndex": "2695531047", + "rootHash": "RDFRxrUL7Z3ucYCg2XWke4zAEq5WQG9jHrQIC/9aRUE=", + "treeSize": "2695531068", + "hashes": [ + "WOEYI7KLYMVUmannSzGxvdEeD8763nFmnGhIdDfpS8M=", + "k+9IerHjRxL7/3JxGxXebZEn6omL0GCwIe4//ftXEcI=", + "qmoLDO2EEwo+1eG3ss//HBj1m69Nuog1rjIplaREsdY=", + "zLFCbn9kXww+7J/jvRANuBe+2Q3GVde6KiFKcdqDqo4=", + "kzEkPAWhg7kqUsXjE7nsVDpmM/x0/bY1Zuj18HRcQNI=", + "ZMnqysESPvKBIYJFMwfpeEWaG5AMorKdYthVVohh2xE=", + "MxMovV/OCyLe8XlrqlR/M9VOLOWt9KHm7Tom/Y0HUeM=", + "Y/1TNslGjlRpnPu4iExTvxSjrElc6GSAMXKXHwK2fmQ=", + "99PoJTYgPWevn9oVlADbWdRGR90JL8Fx/FV0T06o0IA=", + "LQtwekqXPoO3KgXYEfRsV0WYK6Gk0PLLePxJWdZgThQ=", + "qOZd1StyLttRdZ9ojwet4/yO1QqFuSN2bQKQaTXLrkY=", + "uXYCZMF7lS28YUWZqw7VfMV5vdtFS6j7/bavDJtBebk=", + "S39m2eTD1rqRuAMs4r+sGsYIwW0BlTWuysWTKJ8RKVk=", + "qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=", + "xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY=" + ], + "checkpoint": { + "envelope": "rekor.sigstore.dev - 1193050959916656506\n2695531068\nRDFRxrUL7Z3ucYCg2XWke4zAEq5WQG9jHrQIC/9aRUE=\n\n— rekor.sigstore.dev wNI9ajBFAiEAsL/rilvyXYnph5/rJAZPpKHTBYh4hpNE38v8LUppWIACIEDuVpKqb7yGD4h7BQDDbBLeh63JjIp+I1f/ebK74BSZ\n" + } + }, + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiMzUyOGQ2OWM2MWFjNmI1ZjFiMTIxYjRkNDJkNDI0NjJjZDc2NTY3MTQxOGZlNWY1OTg2ZTlkYzhhZmUxZjY2OSJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjMxNmQ3MDNiZWJjMjlkOGQ3MzYyNTE2NjcyYTVhMjUyMDllMDM5YTRmYjczZmU5YTljNjkzOTAxNTZiNTM1ODkifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVZQ0lRREFlZ0J1V2xNYkk5aTVQQjgrcmdaTUZHQmtSd2tVQUlNTGdhTHZSbUdRVHdJaEFPVFlRZUt1NWdSWnB0czM2UlhISFh2cVFkZHdBMWo0MEZjMktzTGVMRkxnIiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VsTGVrTkRRamRIWjBGM1NVSkJaMGxWVTJWSmJYcFdNV012TUZSVmNpdGFTMEZHUXpWa1QxcEpTelZSZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwOVVSWHBOVkVWNlRYcEJlVmRvWTA1TmFsbDNUMVJGZWsxVVJUQk5la0Y1VjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVmhaemhvWmpob1NFZFZNemhxVmpaR1RrVTRSaTlPUTNWR2RHVXdjWE5TV0U5dE5sTUtUa3BITkU5WWVYRXdPRTlJTUhKSFdqZDZWMjVuVldwYWQydEhaRUpSZVRGelZsb3pWazE2UzI1NFpYSjFWM0pOZUV0UFEwSjBRWGRuWjJKTlRVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVjZiRnBTQ2xsdVFUbDViVGR6YUhGS2VuWlJUVlZGV1VkYVRrSjNkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMmRhYTBkQk1WVmtSVkZGUWk5M1UwSnFha05DYVRSaFFtbEhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RRcGhiV3hzVEZWNGNHSnBPVlJaTWtaMVlraHJka3h0WkhCa1IyZ3hXV2s1TTJJelNuSmFiWGgyWkROTmRtUnFTWFZOVXpGb1kyNVNjRnB0Um1wa1F6RjRDbVJYUm5OaFYxcHdXVEpHTUdGWE9YVk1ibXgwWWtWQ2VWcFhXbnBNTW1oc1dWZFNla3d5VG5aYVIxWTBURE5aZVV4cVJYUmlia0owVEZoQ2VXSXpXbXdLWW0xR2RWa3lWWFJqYlZacVlqTmFiR051YTNkUFVWbExTM2RaUWtKQlIwUjJla0ZDUVZGUmNtRklVakJqU0UwMlRIazVNR0l5ZEd4aWFUVm9XVE5TY0FwaU1qVjZURzFrY0dSSGFERlpibFo2V2xoS2FtSXlOVEJhVnpVd1RHMU9kbUpVUVdaQ1oyOXlRbWRGUlVGWlR5OU5RVVZEUWtKR00ySXpTbkphYlhoMkNtUXhPV3RoV0U1M1dWaFNhbUZFUVRKQ1oyOXlRbWRGUlVGWlR5OU5RVVZFUWtOb2JFMXFTbXROVkVGM1RWUlplazVVV1RGTlZGa3dXbFJKZUU1RWJHMEtUMVJzYUZscVZUQmFSRVY0V1ZSWmVFMVVSVFZOZWtwcFRVTnJSME5wYzBkQlVWRkNaemM0ZDBGUlVVVkhNMWw1VEdwRloxRllTakJoVjFwb1dUTlJad3BWV0Zab1lrZHNiV0ZYVG1oa1IyeDJZbXBCYWtKbmIzSkNaMFZGUVZsUEwwMUJSVVpDUWxaYVdWYzFibUZ1Vm5WaGJXeHNURlY0Y0dKcE9WUlpNa1oxQ21KSWEzZFBkMWxMUzNkWlFrSkJSMFIyZWtGQ1FtZFJkR050Vm0xamVUbHZXbGRHYTJONU9XcGlNbEpzWlVNNU1rMXBOSGhNVnpWM1lsTXhkMk50T1RJS1dsYzFhR0p0VG14TVdFcHNXVEk1TWxwWVNqVk5SSE5IUTJselIwRlJVVUpuTnpoM1FWRm5SVXhSZDNKaFNGSXdZMGhOTmt4NU9UQmlNblJzWW1rMWFBcFpNMUp3WWpJMWVreHRaSEJrUjJneFdXNVdlbHBZU21waU1qVXdXbGMxTUV4dFRuWmlWRU5DYldkWlMwdDNXVUpDUVVkRWRucEJRa05SVTBKcGQzbENDbWxIYURCa1NFSjZUMms0ZGxveWJEQmhTRlpwVEcxT2RtSlRPVnBaVnpWdVlXNVdkV0Z0Ykd4TVZYaHdZbWs1VkZreVJuVmlTR3QyVEcxa2NHUkhhREVLV1drNU0ySXpTbkphYlhoMlpETk5kbVJxU1hWTlV6Rm9ZMjVTY0ZwdFJtcGtRekY0WkZkR2MyRlhXbkJaTWtZd1lWYzVkVXh1YkhSaVJVSjVXbGRhZWdwTU1taHNXVmRTZWt3eVRuWmFSMVkwVEROWmVVeHFSWFJpYmtKMFRGaENlV0l6V214aWJVWjFXVEpWZEdOdFZtcGlNMXBzWTI1cmQwOUJXVXRMZDFsQ0NrSkJSMFIyZWtGQ1EyZFJjVVJEYUd4TmFrcHJUVlJCZDAxVVdYcE9WRmt4VFZSWk1GcFVTWGhPUkd4dFQxUnNhRmxxVlRCYVJFVjRXVlJaZUUxVVJUVUtUWHBLYVUxQ01FZERhWE5IUVZGUlFtYzNPSGRCVVhORlJIZDNUbG95YkRCaFNGWnBURmRvZG1NelVteGFSRUUwUW1kdmNrSm5SVVZCV1U4dlRVRkZUUXBDUTI5TlMwZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNVdsbFhOVzVoYmxaMVlXMXNiRXhWZUhCaWFUbFVXVEpHZFdKSWEzZFBRVmxMQ2t0M1dVSkNRVWRFZG5wQlFrUlJVWEZFUTJoc1RXcEthMDFVUVhkTlZGbDZUbFJaTVUxVVdUQmFWRWw0VGtSc2JVOVViR2haYWxVd1drUkZlRmxVV1hnS1RWUkZOVTE2U21sTlJEQkhRMmx6UjBGUlVVSm5OemgzUVZFMFJVeDNkM1JqYlZadFkzazViMXBYUm10amVUbHFZakpTYkdWRE9USk5hVFI0VEZjMWR3cGlVekYzWTIwNU1scFhOV2hpYlU1c1RGaEtiRmt5T1RKYVdFbzFUVUp2UjBOcGMwZEJVVkZDWnpjNGQwRlJPRVZFUVhkTFRWUkZNVTVxVFRCTmFsa3hDazE2UVhoQ1oyOXlRbWRGUlVGWlR5OU5RVVZSUWtOTlRVbFhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnFRVnBDWjI5eVFtZEZSVUZaVHk5TlFVVlNRa0Z6VFVOVVNYbE9SRTB6VFVSbk5VOUVRMEp0WjFsTFMzZFpRa0pCUjBSMmVrRkNSV2RUUWdwcGQzbENhVWRvTUdSSVFucFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVXbGxYTlc1aGJsWjFZVzFzYkV4VmVIQmlhVGxVV1RKR2RXSklhM1pNYldSd0NtUkhhREZaYVRrellqTktjbHB0ZUhaa00wMTJaR3BKZFUxVE1XaGpibEp3V20xR2FtUkRNWGhrVjBaellWZGFjRmt5UmpCaFZ6bDFURzVzZEdKRlFua0tXbGRhZWt3eWFHeFpWMUo2VERKT2RscEhWalJNTTFsNVRHcEZkR0p1UW5STVdFSjVZak5hYkdKdFJuVlpNbFYwWTIxV2FtSXpXbXhqYm10M1QwRlpTd3BMZDFsQ1FrRkhSSFo2UVVKRmQxRnhSRU5vYkUxcVNtdE5WRUYzVFZSWmVrNVVXVEZOVkZrd1dsUkplRTVFYkcxUFZHeG9XV3BWTUZwRVJYaFpWRmw0Q2sxVVJUVk5la3BwVFVORlIwTnBjMGRCVVZGQ1p6YzRkMEZTVVVWRmQzZFNaREk1ZVdFeVduTmlNMlJtV2tkc2VtTkhSakJaTW1kM1dFRlpTMHQzV1VJS1FrRkhSSFo2UVVKR1VWSlBSRVY0YjJSSVVuZGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbGRYUm5WYU1uQXhZbTF3Y0ZwVE1VMWhWelIyVlRKT2FBcGliWGcxVERKR2FtUkhiSFppYmsxMlkyNVdkV041T0hwT1JHTXhUa1JaTTAxNlZUQk9lVGxvWkVoU2JHSllRakJqZVRoNFRVSlpSME5wYzBkQlVWRkNDbWMzT0hkQlVsbEZRMEYzUjJOSVZtbGlSMnhxVFVaM1IwTnBjMGRCVVZGQ1p6YzRkMEZTWjBWVVozaE5ZMjFXZDJKNmNGcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnBPVlJaTWtaMVlraHJObU50Vm0xUGJrcHNXbTVOZG1GSFZtaGFTRTEyV1RJNWExcFlaM1prYWtsMVRWTXhkV05ITUhSalNFcDJaRzFXZFFwWlZ6VnFXbE14ZVZwWFRuWmtiVlo1WlZSRFFtbFJXVXRMZDFsQ1FrRklWMlZSU1VWQloxSTNRa2hyUVdSM1FqRkJUakE1VFVkeVIzaDRSWGxaZUd0bENraEtiRzVPZDB0cFUydzJORE5xZVhRdk5HVkxZMjlCZGt0bE5rOUJRVUZDYjBweFMzbG5VVUZCUVZGRVFVVlpkMUpCU1dkak1rTkNUMnh3WW5keVV6UUtPV1ZHYVRKUGJEZHlSVTl6U2t3M1QzaE9lbTVMUkhoMUsxaHFlbXRNYjBOSlFXazJaVUpZUWxkRUsyRlRORmxOU1cxM2FFMW1NRTF0V0ZSQmRWbHpNZ3BvZHpRd1FqaDJOeTlvWmxWTlFXOUhRME54UjFOTk5EbENRVTFFUVRKblFVMUhWVU5OUTJ0b1J6bE9hR1F5YTNsUVFVUk5jRkZETjJnNVlYaFhRalIyQ2xvMFdWSk9PRE53Wlc5bmRHRnlSblpCYmpWT1pWZHdkRlIzWmtOMFFWRTFORTFHZGpsUlNYaEJURFZCVW1KS1RYTmlhVE5TTVdodVZXMUZhREZ3WlVJS2IwTldjVVZOUlhWMlNsUmpjRFF6ZEU5cVJGWmxOMjlzWTBwV2QyUnRNVTFyVTBZM2MwYzJNa2RuUFQwS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9XX19" + } + ], + "timestampVerificationData": {} + }, + "dsseEnvelope": { + "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoicGtnOm5wbS8lNDBzY2FubHkvZW5naW5lLWpzcXJAMi4xLjAiLCJkaWdlc3QiOnsic2hhNTEyIjoiNDU1MGE3YjU2MTk2ZTNmNjg2ZGU0MWNmMjc4ZjlmMjhjOWE5ZDU3Y2NiNmU2Mjc3YTBmZjcwN2VjZDg0MjJjMjRkMGJhNTNmNjM4NTFkMTgxYjRiMDhiNjIwMjZmYzVkMmIzMTkxYzUyMmJjOWMzOGQ3NzQ1YTBkNTg4NTRkMzUifX1dLCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9zbHNhLmRldi9wcm92ZW5hbmNlL3YxIiwicHJlZGljYXRlIjp7ImJ1aWxkRGVmaW5pdGlvbiI6eyJidWlsZFR5cGUiOiJodHRwczovL3Nsc2EtZnJhbWV3b3JrLmdpdGh1Yi5pby9naXRodWItYWN0aW9ucy1idWlsZHR5cGVzL3dvcmtmbG93L3YxIiwiZXh0ZXJuYWxQYXJhbWV0ZXJzIjp7IndvcmtmbG93Ijp7InJlZiI6InJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeSIsInJlcG9zaXRvcnkiOiJodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5IiwicGF0aCI6Ii5naXRodWIvd29ya2Zsb3dzL3YyLjEtYXJ0aWZhY3QtcXVhbGlmaWNhdGlvbi55bWwifSwic291cmNlX2NvbW1pdCI6IjZiMDE3YjUzYTQ0MDRmNGZlYWI3NzZhYzExMWIwZWE5ZGFjZjI3MzQifSwiaW50ZXJuYWxQYXJhbWV0ZXJzIjp7ImdpdGh1YiI6eyJldmVudF9uYW1lIjoid29ya2Zsb3dfZGlzcGF0Y2giLCJyZXBvc2l0b3J5X2lkIjoiMTE1NjM0MjY1MyIsInJlcG9zaXRvcnlfb3duZXJfaWQiOiIyMjQzNzA4OTgifX0sInJlc29sdmVkRGVwZW5kZW5jaWVzIjpbeyJ1cmkiOiJnaXQraHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seUByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkiLCJkaWdlc3QiOnsiZ2l0Q29tbWl0IjoiZTIyZDEwMDE2MzU2NTE2NGUyMTQ5Zjk5YWI1NGQxMWE2MTExOTMyYiJ9fSx7InVyaSI6ImdpdCtodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5QDZiMDE3YjUzYTQ0MDRmNGZlYWI3NzZhYzExMWIwZWE5ZGFjZjI3MzQiLCJkaWdlc3QiOnsiZ2l0Q29tbWl0IjoiNmIwMTdiNTNhNDQwNGY0ZmVhYjc3NmFjMTExYjBlYTlkYWNmMjczNCJ9fV19LCJydW5EZXRhaWxzIjp7ImJ1aWxkZXIiOnsiaWQiOiJodHRwczovL2dpdGh1Yi5jb20vYWN0aW9ucy9ydW5uZXIvZ2l0aHViLWhvc3RlZCJ9LCJtZXRhZGF0YSI6eyJpbnZvY2F0aW9uSWQiOiJodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5L2FjdGlvbnMvcnVucy8zNDc1NDY3MzU0Ny9hdHRlbXB0cy8xIn19fX0=", + "payloadType": "application/vnd.in-toto+json", + "signatures": [ + { + "sig": "MEYCIQDAegBuWlMbI9i5PB8+rgZMFGBkRwkUAIMLgaLvRmGQTwIhAOTYQeKu5gRZpts36RXHHXvqQddwA1j40Fc2KsLeLFLg" + } + ] + } +} diff --git a/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-engine-zxing-cpp-wasm-2.1.0.tgz.sigstore.json b/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-engine-zxing-cpp-wasm-2.1.0.tgz.sigstore.json new file mode 100644 index 0000000..cc00bda --- /dev/null +++ b/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-engine-zxing-cpp-wasm-2.1.0.tgz.sigstore.json @@ -0,0 +1,62 @@ +{ + "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", + "verificationMaterial": { + "certificate": { + "rawBytes": "MIIILTCCB7OgAwIBAgIUUCMYFsnJiJphSYn8wkxmwvlSJA4wCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTEzMTEzMzAzWhcNMjYwOTEzMTE0MzAzWjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEWu6vphi61TP2K48Cg1cz8KXcsWwqI8elXqXKl+O1QHz20fDdhhyLJ+anDIZogxgWjERpZcyrtl7u60sNjcaPhKOCBtIwggbOMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUV1b2at6B7+bv2dpzJ2NTHM06dSAwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wgZkGA1UdEQEB/wSBjjCBi4aBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAfBgorBgEEAYO/MAECBBF3b3JrZmxvd19kaXNwYXRjaDA2BgorBgEEAYO/MAEDBChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCkGCisGAQQBg78wAQQEG3YyLjEgQXJ0aWZhY3QgUXVhbGlmaWNhdGlvbjAjBgorBgEEAYO/MAEFBBVZYW5nanVuamllLUxpbi9TY2FubHkwOwYKKwYBBAGDvzABBgQtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTCBmgYKKwYBBAGDvzABCQSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABCgQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMB0GCisGAQQBg78wAQsEDwwNZ2l0aHViLWhvc3RlZDA4BgorBgEEAYO/MAEMBCoMKGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkwOAYKKwYBBAGDvzABDQQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMD0GCisGAQQBg78wAQ4ELwwtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MBoGCisGAQQBg78wAQ8EDAwKMTE1NjM0MjY1MzAxBgorBgEEAYO/MAEQBCMMIWh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbjAZBgorBgEEAYO/MAERBAsMCTIyNDM3MDg5ODCBmgYKKwYBBAGDvzABEgSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABEwQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCEGCisGAQQBg78wARQEEwwRd29ya2Zsb3dfZGlzcGF0Y2gwXAYKKwYBBAGDvzABFQRODExodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5L2FjdGlvbnMvcnVucy8zNDc1NDY3MzU0Ny9hdHRlbXB0cy8xMBYGCisGAQQBg78wARYECAwGcHVibGljMFwGCisGAQQBg78wARgETgxMcmVwbzpZYW5nanVuamllLUxpbi9TY2FubHk6cmVmOnJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeTCBiwYKKwYBBAHWeQIEAgR9BHsAeQB3AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABoJqKzmwAAAQDAEgwRgIhAPU62wwbZegq4mUKowNbJz8VSVOP42Kmke0HAcu52u+ZAiEAy6Uz5ZacIjJPV9cu+nfgifRYZiPAcmxXMDoO9b/WHWMwCgYIKoZIzj0EAwMDaAAwZQIwDJQX2p9YC6Fk294bGaGzIAu5rXKjdRie4PqqtrkH6KJpk5CZyHXzIbDCM3bX9naUAjEAqY0YDeL9KkhGuRzO1KXCkkSHL85lQkhMSOeIFxiQMF5OUtoRB2FpJetq1vKZmkNh" + }, + "tlogEntries": [ + { + "logIndex": "2817435471", + "logId": { + "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=" + }, + "kindVersion": { + "kind": "dsse", + "version": "0.0.1" + }, + "integratedTime": "1789299183", + "inclusionPromise": { + "signedEntryTimestamp": "MEUCIC7hMNr14zwG/0+Rz2kajjL3wdoU+TVUWSWyHirCkUWaAiEAsCjSS158hqniMVtDq8CWJwGGMJMev9nSBPw8F56CSRI=" + }, + "inclusionProof": { + "logIndex": "2695531209", + "rootHash": "FKty+5XGjqk0w88TGvUwbkQzanFcQOsM1IIUAf+M3t0=", + "treeSize": "2695531255", + "hashes": [ + "xNblV89SLwmSNS3qB2ZMDnFF/TqFKwe5OZSAD7qmYQk=", + "457jfaO5qt0cVVO+MwN6tCsbAwYk6QjWHwt5NAPfxHI=", + "Nrr2ZSZgh5WoE0JjkU6Ga8gyQncxrZKNiuVyWANOOA4=", + "kwJmouADOgEbZrGIMYQgdOGKoJ8LKhyA8BTBvTo5eqA=", + "hddlaIowLG3nKqVUXwqgxd4+a2pv6rY48pMOpsVay5I=", + "ghpI4opEypKKPpUDIffX4e28hGlDnembiYWRaecAyOg=", + "U4PULRZF7bjE9Nd/cMXjMhJgU/EUNPzdRrOzxONrxXc=", + "ClBHKHmqooANqbUlh35aQP3wPFxAVtIo+mGoYlh9Aho=", + "MxMovV/OCyLe8XlrqlR/M9VOLOWt9KHm7Tom/Y0HUeM=", + "Y/1TNslGjlRpnPu4iExTvxSjrElc6GSAMXKXHwK2fmQ=", + "99PoJTYgPWevn9oVlADbWdRGR90JL8Fx/FV0T06o0IA=", + "LQtwekqXPoO3KgXYEfRsV0WYK6Gk0PLLePxJWdZgThQ=", + "qOZd1StyLttRdZ9ojwet4/yO1QqFuSN2bQKQaTXLrkY=", + "uXYCZMF7lS28YUWZqw7VfMV5vdtFS6j7/bavDJtBebk=", + "S39m2eTD1rqRuAMs4r+sGsYIwW0BlTWuysWTKJ8RKVk=", + "qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=", + "xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY=" + ], + "checkpoint": { + "envelope": "rekor.sigstore.dev - 1193050959916656506\n2695531255\nFKty+5XGjqk0w88TGvUwbkQzanFcQOsM1IIUAf+M3t0=\n\n— rekor.sigstore.dev wNI9ajBEAiBJpEVINMIBOWC00YeVB2LYDZ9VFKvHKv5woR5KSH3DuQIgPJLAAVryYHfUGfXD4/JoP9PppjlXWaZSivEflGe2Gus=\n" + } + }, + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiZTI3ZWM5YmUyYzFkZmJmODBmMTNiOTk2YTViZjJlYzVkOWM1YTBiODViZWZjMDA1ZjFjNmJiMzU3MzBhNzVmNSJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjA4ZTMxZGQwYmU2ZTViYTE2NmUxM2ZhMTkxMzRlNmQyYzRmYWMxY2JlMjMyMmExNDQ4NWY5OGJkMjNkY2QzNGYifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVZQ0lRQzluaGJOZlpmUFMyc0lhdU1NTC9JL0dyZ2t1Yy9sR0ZzVHZHcVVWdkR0N0FJaEFKbHpGNkZiVW56cUJMWUdRZVR3dXNHYVpabGU0OS9ZbU14Q1lLaUZIQUZzIiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VsTVZFTkRRamRQWjBGM1NVSkJaMGxWVlVOTldVWnpia3BwU25Cb1UxbHVPSGRyZUcxM2RteFRTa0UwZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwOVVSWHBOVkVWNlRYcEJlbGRvWTA1TmFsbDNUMVJGZWsxVVJUQk5la0Y2VjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVlhkVFoyY0docE5qRlVVREpMTkRoRFp6RmplamhMV0dOelYzZHhTVGhsYkZoeFdFc0tiQ3RQTVZGSWVqSXdaa1JrYUdoNVRFb3JZVzVFU1ZwdlozaG5WMnBGVW5CYVkzbHlkR3czZFRZd2MwNXFZMkZRYUV0UFEwSjBTWGRuWjJKUFRVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVldNV0l5Q21GME5rSTNLMkoyTW1Sd2Vrb3lUbFJJVFRBMlpGTkJkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMmRhYTBkQk1WVmtSVkZGUWk5M1UwSnFha05DYVRSaFFtbEhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RRcGhiV3hzVEZWNGNHSnBPVlJaTWtaMVlraHJka3h0WkhCa1IyZ3hXV2s1TTJJelNuSmFiWGgyWkROTmRtUnFTWFZOVXpGb1kyNVNjRnB0Um1wa1F6RjRDbVJYUm5OaFYxcHdXVEpHTUdGWE9YVk1ibXgwWWtWQ2VWcFhXbnBNTW1oc1dWZFNla3d5VG5aYVIxWTBURE5aZVV4cVJYUmlia0owVEZoQ2VXSXpXbXdLWW0xR2RWa3lWWFJqYlZacVlqTmFiR051YTNkUFVWbExTM2RaUWtKQlIwUjJla0ZDUVZGUmNtRklVakJqU0UwMlRIazVNR0l5ZEd4aWFUVm9XVE5TY0FwaU1qVjZURzFrY0dSSGFERlpibFo2V2xoS2FtSXlOVEJhVnpVd1RHMU9kbUpVUVdaQ1oyOXlRbWRGUlVGWlR5OU5RVVZEUWtKR00ySXpTbkphYlhoMkNtUXhPV3RoV0U1M1dWaFNhbUZFUVRKQ1oyOXlRbWRGUlVGWlR5OU5RVVZFUWtOb2JFMXFTbXROVkVGM1RWUlplazVVV1RGTlZGa3dXbFJKZUU1RWJHMEtUMVJzYUZscVZUQmFSRVY0V1ZSWmVFMVVSVFZOZWtwcFRVTnJSME5wYzBkQlVWRkNaemM0ZDBGUlVVVkhNMWw1VEdwRloxRllTakJoVjFwb1dUTlJad3BWV0Zab1lrZHNiV0ZYVG1oa1IyeDJZbXBCYWtKbmIzSkNaMFZGUVZsUEwwMUJSVVpDUWxaYVdWYzFibUZ1Vm5WaGJXeHNURlY0Y0dKcE9WUlpNa1oxQ21KSWEzZFBkMWxMUzNkWlFrSkJSMFIyZWtGQ1FtZFJkR050Vm0xamVUbHZXbGRHYTJONU9XcGlNbEpzWlVNNU1rMXBOSGhNVnpWM1lsTXhkMk50T1RJS1dsYzFhR0p0VG14TVdFcHNXVEk1TWxwWVNqVk5SSE5IUTJselIwRlJVVUpuTnpoM1FWRm5SVXhSZDNKaFNGSXdZMGhOTmt4NU9UQmlNblJzWW1rMWFBcFpNMUp3WWpJMWVreHRaSEJrUjJneFdXNVdlbHBZU21waU1qVXdXbGMxTUV4dFRuWmlWRU5DYldkWlMwdDNXVUpDUVVkRWRucEJRa05SVTBKcGQzbENDbWxIYURCa1NFSjZUMms0ZGxveWJEQmhTRlpwVEcxT2RtSlRPVnBaVnpWdVlXNVdkV0Z0Ykd4TVZYaHdZbWs1VkZreVJuVmlTR3QyVEcxa2NHUkhhREVLV1drNU0ySXpTbkphYlhoMlpETk5kbVJxU1hWTlV6Rm9ZMjVTY0ZwdFJtcGtRekY0WkZkR2MyRlhXbkJaTWtZd1lWYzVkVXh1YkhSaVJVSjVXbGRhZWdwTU1taHNXVmRTZWt3eVRuWmFSMVkwVEROWmVVeHFSWFJpYmtKMFRGaENlV0l6V214aWJVWjFXVEpWZEdOdFZtcGlNMXBzWTI1cmQwOUJXVXRMZDFsQ0NrSkJSMFIyZWtGQ1EyZFJjVVJEYUd4TmFrcHJUVlJCZDAxVVdYcE9WRmt4VFZSWk1GcFVTWGhPUkd4dFQxUnNhRmxxVlRCYVJFVjRXVlJaZUUxVVJUVUtUWHBLYVUxQ01FZERhWE5IUVZGUlFtYzNPSGRCVVhORlJIZDNUbG95YkRCaFNGWnBURmRvZG1NelVteGFSRUUwUW1kdmNrSm5SVVZCV1U4dlRVRkZUUXBDUTI5TlMwZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNVdsbFhOVzVoYmxaMVlXMXNiRXhWZUhCaWFUbFVXVEpHZFdKSWEzZFBRVmxMQ2t0M1dVSkNRVWRFZG5wQlFrUlJVWEZFUTJoc1RXcEthMDFVUVhkTlZGbDZUbFJaTVUxVVdUQmFWRWw0VGtSc2JVOVViR2haYWxVd1drUkZlRmxVV1hnS1RWUkZOVTE2U21sTlJEQkhRMmx6UjBGUlVVSm5OemgzUVZFMFJVeDNkM1JqYlZadFkzazViMXBYUm10amVUbHFZakpTYkdWRE9USk5hVFI0VEZjMWR3cGlVekYzWTIwNU1scFhOV2hpYlU1c1RGaEtiRmt5T1RKYVdFbzFUVUp2UjBOcGMwZEJVVkZDWnpjNGQwRlJPRVZFUVhkTFRWUkZNVTVxVFRCTmFsa3hDazE2UVhoQ1oyOXlRbWRGUlVGWlR5OU5RVVZSUWtOTlRVbFhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnFRVnBDWjI5eVFtZEZSVUZaVHk5TlFVVlNRa0Z6VFVOVVNYbE9SRTB6VFVSbk5VOUVRMEp0WjFsTFMzZFpRa0pCUjBSMmVrRkNSV2RUUWdwcGQzbENhVWRvTUdSSVFucFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVXbGxYTlc1aGJsWjFZVzFzYkV4VmVIQmlhVGxVV1RKR2RXSklhM1pNYldSd0NtUkhhREZaYVRrellqTktjbHB0ZUhaa00wMTJaR3BKZFUxVE1XaGpibEp3V20xR2FtUkRNWGhrVjBaellWZGFjRmt5UmpCaFZ6bDFURzVzZEdKRlFua0tXbGRhZWt3eWFHeFpWMUo2VERKT2RscEhWalJNTTFsNVRHcEZkR0p1UW5STVdFSjVZak5hYkdKdFJuVlpNbFYwWTIxV2FtSXpXbXhqYm10M1QwRlpTd3BMZDFsQ1FrRkhSSFo2UVVKRmQxRnhSRU5vYkUxcVNtdE5WRUYzVFZSWmVrNVVXVEZOVkZrd1dsUkplRTVFYkcxUFZHeG9XV3BWTUZwRVJYaFpWRmw0Q2sxVVJUVk5la3BwVFVORlIwTnBjMGRCVVZGQ1p6YzRkMEZTVVVWRmQzZFNaREk1ZVdFeVduTmlNMlJtV2tkc2VtTkhSakJaTW1kM1dFRlpTMHQzV1VJS1FrRkhSSFo2UVVKR1VWSlBSRVY0YjJSSVVuZGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbGRYUm5WYU1uQXhZbTF3Y0ZwVE1VMWhWelIyVlRKT2FBcGliWGcxVERKR2FtUkhiSFppYmsxMlkyNVdkV041T0hwT1JHTXhUa1JaTTAxNlZUQk9lVGxvWkVoU2JHSllRakJqZVRoNFRVSlpSME5wYzBkQlVWRkNDbWMzT0hkQlVsbEZRMEYzUjJOSVZtbGlSMnhxVFVaM1IwTnBjMGRCVVZGQ1p6YzRkMEZTWjBWVVozaE5ZMjFXZDJKNmNGcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnBPVlJaTWtaMVlraHJObU50Vm0xUGJrcHNXbTVOZG1GSFZtaGFTRTEyV1RJNWExcFlaM1prYWtsMVRWTXhkV05ITUhSalNFcDJaRzFXZFFwWlZ6VnFXbE14ZVZwWFRuWmtiVlo1WlZSRFFtbDNXVXRMZDFsQ1FrRklWMlZSU1VWQloxSTVRa2h6UVdWUlFqTkJUakE1VFVkeVIzaDRSWGxaZUd0bENraEtiRzVPZDB0cFUydzJORE5xZVhRdk5HVkxZMjlCZGt0bE5rOUJRVUZDYjBweFMzcHRkMEZCUVZGRVFVVm5kMUpuU1doQlVGVTJNbmQzWWxwbFozRUtORzFWUzI5M1RtSktlamhXVTFaUFVEUXlTMjFyWlRCSVFXTjFOVEoxSzFwQmFVVkJlVFpWZWpWYVlXTkpha3BRVmpsamRTdHVabWRwWmxKWldtbFFRUXBqYlhoWVRVUnZUemxpTDFkSVYwMTNRMmRaU1V0dldrbDZhakJGUVhkTlJHRkJRWGRhVVVsM1JFcFJXREp3T1ZsRE5rWnJNamswWWtkaFIzcEpRWFUxQ25KWVMycGtVbWxsTkZCeGNYUnlhMGcyUzBwd2F6VkRXbmxJV0hwSllrUkRUVE5pV0RsdVlWVkJha1ZCY1Zrd1dVUmxURGxMYTJoSGRWSjZUekZMV0VNS2EydFRTRXc0Tld4UmEyaE5VMDlsU1VaNGFWRk5SalZQVlhSdlVrSXlSbkJLWlhSeE1YWkxXbTFyVG1nS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9XX19" + } + ], + "timestampVerificationData": {} + }, + "dsseEnvelope": { + "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoicGtnOm5wbS8lNDBzY2FubHkvZW5naW5lLXp4aW5nLWNwcC13YXNtQDIuMS4wIiwiZGlnZXN0Ijp7InNoYTUxMiI6IjQ2NzM0YzQ5Y2MwNzc2YjI2ZWRjMWZhNjI2MWY3OGEwMjhhNmRkMGVjOTdhNzQzM2NkMjIxMDE2NDg4MzZmYWViYTA0YzU0N2U5MDUxMDM3MmZhN2RhNDEzM2QwMzAzZjg1MTE4Y2VjMmIxNzEwMDU4MWExNjBjYjA0N2JiYzM5In19XSwicHJlZGljYXRlVHlwZSI6Imh0dHBzOi8vc2xzYS5kZXYvcHJvdmVuYW5jZS92MSIsInByZWRpY2F0ZSI6eyJidWlsZERlZmluaXRpb24iOnsiYnVpbGRUeXBlIjoiaHR0cHM6Ly9zbHNhLWZyYW1ld29yay5naXRodWIuaW8vZ2l0aHViLWFjdGlvbnMtYnVpbGR0eXBlcy93b3JrZmxvdy92MSIsImV4dGVybmFsUGFyYW1ldGVycyI6eyJ3b3JrZmxvdyI6eyJyZWYiOiJyZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkiLCJyZXBvc2l0b3J5IjoiaHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seSIsInBhdGgiOiIuZ2l0aHViL3dvcmtmbG93cy92Mi4xLWFydGlmYWN0LXF1YWxpZmljYXRpb24ueW1sIn0sInNvdXJjZV9jb21taXQiOiI2YjAxN2I1M2E0NDA0ZjRmZWFiNzc2YWMxMTFiMGVhOWRhY2YyNzM0In0sImludGVybmFsUGFyYW1ldGVycyI6eyJnaXRodWIiOnsiZXZlbnRfbmFtZSI6IndvcmtmbG93X2Rpc3BhdGNoIiwicmVwb3NpdG9yeV9pZCI6IjExNTYzNDI2NTMiLCJyZXBvc2l0b3J5X293bmVyX2lkIjoiMjI0MzcwODk4In19LCJyZXNvbHZlZERlcGVuZGVuY2llcyI6W3sidXJpIjoiZ2l0K2h0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHlAcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5IiwiZGlnZXN0Ijp7ImdpdENvbW1pdCI6ImUyMmQxMDAxNjM1NjUxNjRlMjE0OWY5OWFiNTRkMTFhNjExMTkzMmIifX0seyJ1cmkiOiJnaXQraHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seUA2YjAxN2I1M2E0NDA0ZjRmZWFiNzc2YWMxMTFiMGVhOWRhY2YyNzM0IiwiZGlnZXN0Ijp7ImdpdENvbW1pdCI6IjZiMDE3YjUzYTQ0MDRmNGZlYWI3NzZhYzExMWIwZWE5ZGFjZjI3MzQifX1dfSwicnVuRGV0YWlscyI6eyJidWlsZGVyIjp7ImlkIjoiaHR0cHM6Ly9naXRodWIuY29tL2FjdGlvbnMvcnVubmVyL2dpdGh1Yi1ob3N0ZWQifSwibWV0YWRhdGEiOnsiaW52b2NhdGlvbklkIjoiaHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seS9hY3Rpb25zL3J1bnMvMzQ3NTQ2NzM1NDcvYXR0ZW1wdHMvMSJ9fX19", + "payloadType": "application/vnd.in-toto+json", + "signatures": [ + { + "sig": "MEYCIQC9nhbNfZfPS2sIauMML/I/Grgkuc/lGFsTvGqUVvDt7AIhAJlzF6FbUnzqBLYGQeTwusGaZZle49/YmMxCYKiFHAFs" + } + ] + } +} diff --git a/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-engine-zxing-js-2.1.0.tgz.sigstore.json b/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-engine-zxing-js-2.1.0.tgz.sigstore.json new file mode 100644 index 0000000..0bb58a0 --- /dev/null +++ b/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-engine-zxing-js-2.1.0.tgz.sigstore.json @@ -0,0 +1,62 @@ +{ + "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", + "verificationMaterial": { + "certificate": { + "rawBytes": "MIIIKzCCB7KgAwIBAgIUO5QHw+JlONjB7oCrJXfj+R1sKz0wCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTEzMTEzMzA0WhcNMjYwOTEzMTE0MzA0WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYb8SsLBPbt2uQwMU3+t1m8YPf9kHhvBUtRuPLdZGk7NtYMgBj41Cd30oRJACAAIVEXVEonKVb3ETmhbuDefDwKOCBtEwggbNMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUiPgwsEbdtnZMCNmkM2oTgmtyIRIwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wgZkGA1UdEQEB/wSBjjCBi4aBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAfBgorBgEEAYO/MAECBBF3b3JrZmxvd19kaXNwYXRjaDA2BgorBgEEAYO/MAEDBChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCkGCisGAQQBg78wAQQEG3YyLjEgQXJ0aWZhY3QgUXVhbGlmaWNhdGlvbjAjBgorBgEEAYO/MAEFBBVZYW5nanVuamllLUxpbi9TY2FubHkwOwYKKwYBBAGDvzABBgQtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTCBmgYKKwYBBAGDvzABCQSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABCgQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMB0GCisGAQQBg78wAQsEDwwNZ2l0aHViLWhvc3RlZDA4BgorBgEEAYO/MAEMBCoMKGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkwOAYKKwYBBAGDvzABDQQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMD0GCisGAQQBg78wAQ4ELwwtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MBoGCisGAQQBg78wAQ8EDAwKMTE1NjM0MjY1MzAxBgorBgEEAYO/MAEQBCMMIWh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbjAZBgorBgEEAYO/MAERBAsMCTIyNDM3MDg5ODCBmgYKKwYBBAGDvzABEgSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABEwQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCEGCisGAQQBg78wARQEEwwRd29ya2Zsb3dfZGlzcGF0Y2gwXAYKKwYBBAGDvzABFQRODExodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5L2FjdGlvbnMvcnVucy8zNDc1NDY3MzU0Ny9hdHRlbXB0cy8xMBYGCisGAQQBg78wARYECAwGcHVibGljMFwGCisGAQQBg78wARgETgxMcmVwbzpZYW5nanVuamllLUxpbi9TY2FubHk6cmVmOnJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeTCBigYKKwYBBAHWeQIEAgR8BHoAeAB2AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABoJqK0skAAAQDAEcwRQIhAO9PTu5tDswaFVcUNh8LsPQroIf2y1gJLLlZPu7uj/GvAiAwA0ybTRjNbWZY+fByMVdekZ6wUyAfWogfHTsryP/RlTAKBggqhkjOPQQDAwNnADBkAjB1258WqnQdsGthc8L6cYlaAJuOJgcB3HMLcdKNpQ/Lk2TcAKacNEdk6sJdYahquC8CMF5jD+JLHGhv4mJ0hzB3fVNyXQQ2YKVXp/kx0jLTSEVXg6+hpl3sVDxiVfqW4V988A==" + }, + "tlogEntries": [ + { + "logIndex": "2817435722", + "logId": { + "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=" + }, + "kindVersion": { + "kind": "dsse", + "version": "0.0.1" + }, + "integratedTime": "1789299184", + "inclusionPromise": { + "signedEntryTimestamp": "MEUCIAabnyQJuoh0RSHBXINEtJQymFu2OyQ+Zo4IdCt+l79TAiEA0CZSZ614vFpANA5YtVTnWIEIDPGaGfG7w5B/oQJq2Ls=" + }, + "inclusionProof": { + "logIndex": "2695531460", + "rootHash": "sh3XMEoGXlcnzW9AuqM93R1MYgeJ03tI1UHPk5Mf5ws=", + "treeSize": "2695531484", + "hashes": [ + "XtjuD97VKUGSgVe9pnXjZR5u4C5Jd0gYVWr/NtJ1zQc=", + "i/o6lOe3MeueL4gx/HpcWX8/EgUup6kQT3uXXqjKE3o=", + "gB4nQsKgB4StUX7v3UidiGF3zsc9ejrXnQI9Ws8xTUY=", + "qgnuphhMoBcacpsT6F48lCrq3n61CDv6/F0MI9bhV58=", + "+iU4K72eVbXACVpv4NAXxrsPUd4hWnWot1sM57X/1xM=", + "+dohIfsURFzdhRquRj6adefANxAA6DdT/UZdoBZX0Jw=", + "Vl4W9KWCq2GMabak/x1rDlvnKy7nPxV/ohhaMp2z7lc=", + "A2SLOF96NcL9w/gBfDKUNxMEjhethmIGvWFDUi6g4LA=", + "MxMovV/OCyLe8XlrqlR/M9VOLOWt9KHm7Tom/Y0HUeM=", + "Y/1TNslGjlRpnPu4iExTvxSjrElc6GSAMXKXHwK2fmQ=", + "99PoJTYgPWevn9oVlADbWdRGR90JL8Fx/FV0T06o0IA=", + "LQtwekqXPoO3KgXYEfRsV0WYK6Gk0PLLePxJWdZgThQ=", + "qOZd1StyLttRdZ9ojwet4/yO1QqFuSN2bQKQaTXLrkY=", + "uXYCZMF7lS28YUWZqw7VfMV5vdtFS6j7/bavDJtBebk=", + "S39m2eTD1rqRuAMs4r+sGsYIwW0BlTWuysWTKJ8RKVk=", + "qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=", + "xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY=" + ], + "checkpoint": { + "envelope": "rekor.sigstore.dev - 1193050959916656506\n2695531484\nsh3XMEoGXlcnzW9AuqM93R1MYgeJ03tI1UHPk5Mf5ws=\n\n— rekor.sigstore.dev wNI9ajBEAiBNAxQB2mOoRiGN0ZDuxFXT+Pa2YrrWmIZlSjoL0WQdGAIgd16G5v7JouqfrQyaf/n8K2g/Y8r+qXcAPSmN9XlHIVI=\n" + } + }, + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiNzgzNmUzZWEyODc5ZTBmM2MzNzNjYTE4ZjkyYjY5OTU1NWZhMTE1ZDY1MzIzYTU0MjdkNGI1OWRiMmQ0NWQzNSJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImE0ZmY4Y2M1NTNlNWZmYTdmYWFlMTk1NmNmYzAxOWE1OWQ3OWFkZDM5ZGY1ZjhlYzJiNmM0NGJiOGIwMDk2MjMifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVVQ0lRRHMwT2cyS2RmNXA3d3ZFMjJNbHZ3T1NpWEZ4dUFoRk1IVVNnMkt5c0pTNkFJZ2NhS3hyRXAzTDJBaUR5eFVTajZiM0xVVUdVc1BFdGpZL3lZNnBMSWRTakE9IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VsTGVrTkRRamRMWjBGM1NVSkJaMGxWVHpWUlNIY3JTbXhQVG1wQ04yOURja3BZWm1vclVqRnpTM293ZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwOVVSWHBOVkVWNlRYcEJNRmRvWTA1TmFsbDNUMVJGZWsxVVJUQk5la0V3VjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVlpZamhUYzB4Q1VHSjBNblZSZDAxVk15dDBNVzA0V1ZCbU9XdElhSFpDVlhSU2RWQUtUR1JhUjJzM1RuUlpUV2RDYWpReFEyUXpNRzlTU2tGRFFVRkpWa1ZZVmtWdmJrdFdZak5GVkcxb1luVkVaV1pFZDB0UFEwSjBSWGRuWjJKT1RVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVnBVR2QzQ25ORlltUjBibHBOUTA1dGEwMHliMVJuYlhSNVNWSkpkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMmRhYTBkQk1WVmtSVkZGUWk5M1UwSnFha05DYVRSaFFtbEhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RRcGhiV3hzVEZWNGNHSnBPVlJaTWtaMVlraHJka3h0WkhCa1IyZ3hXV2s1TTJJelNuSmFiWGgyWkROTmRtUnFTWFZOVXpGb1kyNVNjRnB0Um1wa1F6RjRDbVJYUm5OaFYxcHdXVEpHTUdGWE9YVk1ibXgwWWtWQ2VWcFhXbnBNTW1oc1dWZFNla3d5VG5aYVIxWTBURE5aZVV4cVJYUmlia0owVEZoQ2VXSXpXbXdLWW0xR2RWa3lWWFJqYlZacVlqTmFiR051YTNkUFVWbExTM2RaUWtKQlIwUjJla0ZDUVZGUmNtRklVakJqU0UwMlRIazVNR0l5ZEd4aWFUVm9XVE5TY0FwaU1qVjZURzFrY0dSSGFERlpibFo2V2xoS2FtSXlOVEJhVnpVd1RHMU9kbUpVUVdaQ1oyOXlRbWRGUlVGWlR5OU5RVVZEUWtKR00ySXpTbkphYlhoMkNtUXhPV3RoV0U1M1dWaFNhbUZFUVRKQ1oyOXlRbWRGUlVGWlR5OU5RVVZFUWtOb2JFMXFTbXROVkVGM1RWUlplazVVV1RGTlZGa3dXbFJKZUU1RWJHMEtUMVJzYUZscVZUQmFSRVY0V1ZSWmVFMVVSVFZOZWtwcFRVTnJSME5wYzBkQlVWRkNaemM0ZDBGUlVVVkhNMWw1VEdwRloxRllTakJoVjFwb1dUTlJad3BWV0Zab1lrZHNiV0ZYVG1oa1IyeDJZbXBCYWtKbmIzSkNaMFZGUVZsUEwwMUJSVVpDUWxaYVdWYzFibUZ1Vm5WaGJXeHNURlY0Y0dKcE9WUlpNa1oxQ21KSWEzZFBkMWxMUzNkWlFrSkJSMFIyZWtGQ1FtZFJkR050Vm0xamVUbHZXbGRHYTJONU9XcGlNbEpzWlVNNU1rMXBOSGhNVnpWM1lsTXhkMk50T1RJS1dsYzFhR0p0VG14TVdFcHNXVEk1TWxwWVNqVk5SSE5IUTJselIwRlJVVUpuTnpoM1FWRm5SVXhSZDNKaFNGSXdZMGhOTmt4NU9UQmlNblJzWW1rMWFBcFpNMUp3WWpJMWVreHRaSEJrUjJneFdXNVdlbHBZU21waU1qVXdXbGMxTUV4dFRuWmlWRU5DYldkWlMwdDNXVUpDUVVkRWRucEJRa05SVTBKcGQzbENDbWxIYURCa1NFSjZUMms0ZGxveWJEQmhTRlpwVEcxT2RtSlRPVnBaVnpWdVlXNVdkV0Z0Ykd4TVZYaHdZbWs1VkZreVJuVmlTR3QyVEcxa2NHUkhhREVLV1drNU0ySXpTbkphYlhoMlpETk5kbVJxU1hWTlV6Rm9ZMjVTY0ZwdFJtcGtRekY0WkZkR2MyRlhXbkJaTWtZd1lWYzVkVXh1YkhSaVJVSjVXbGRhZWdwTU1taHNXVmRTZWt3eVRuWmFSMVkwVEROWmVVeHFSWFJpYmtKMFRGaENlV0l6V214aWJVWjFXVEpWZEdOdFZtcGlNMXBzWTI1cmQwOUJXVXRMZDFsQ0NrSkJSMFIyZWtGQ1EyZFJjVVJEYUd4TmFrcHJUVlJCZDAxVVdYcE9WRmt4VFZSWk1GcFVTWGhPUkd4dFQxUnNhRmxxVlRCYVJFVjRXVlJaZUUxVVJUVUtUWHBLYVUxQ01FZERhWE5IUVZGUlFtYzNPSGRCVVhORlJIZDNUbG95YkRCaFNGWnBURmRvZG1NelVteGFSRUUwUW1kdmNrSm5SVVZCV1U4dlRVRkZUUXBDUTI5TlMwZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNVdsbFhOVzVoYmxaMVlXMXNiRXhWZUhCaWFUbFVXVEpHZFdKSWEzZFBRVmxMQ2t0M1dVSkNRVWRFZG5wQlFrUlJVWEZFUTJoc1RXcEthMDFVUVhkTlZGbDZUbFJaTVUxVVdUQmFWRWw0VGtSc2JVOVViR2haYWxVd1drUkZlRmxVV1hnS1RWUkZOVTE2U21sTlJEQkhRMmx6UjBGUlVVSm5OemgzUVZFMFJVeDNkM1JqYlZadFkzazViMXBYUm10amVUbHFZakpTYkdWRE9USk5hVFI0VEZjMWR3cGlVekYzWTIwNU1scFhOV2hpYlU1c1RGaEtiRmt5T1RKYVdFbzFUVUp2UjBOcGMwZEJVVkZDWnpjNGQwRlJPRVZFUVhkTFRWUkZNVTVxVFRCTmFsa3hDazE2UVhoQ1oyOXlRbWRGUlVGWlR5OU5RVVZSUWtOTlRVbFhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnFRVnBDWjI5eVFtZEZSVUZaVHk5TlFVVlNRa0Z6VFVOVVNYbE9SRTB6VFVSbk5VOUVRMEp0WjFsTFMzZFpRa0pCUjBSMmVrRkNSV2RUUWdwcGQzbENhVWRvTUdSSVFucFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVXbGxYTlc1aGJsWjFZVzFzYkV4VmVIQmlhVGxVV1RKR2RXSklhM1pNYldSd0NtUkhhREZaYVRrellqTktjbHB0ZUhaa00wMTJaR3BKZFUxVE1XaGpibEp3V20xR2FtUkRNWGhrVjBaellWZGFjRmt5UmpCaFZ6bDFURzVzZEdKRlFua0tXbGRhZWt3eWFHeFpWMUo2VERKT2RscEhWalJNTTFsNVRHcEZkR0p1UW5STVdFSjVZak5hYkdKdFJuVlpNbFYwWTIxV2FtSXpXbXhqYm10M1QwRlpTd3BMZDFsQ1FrRkhSSFo2UVVKRmQxRnhSRU5vYkUxcVNtdE5WRUYzVFZSWmVrNVVXVEZOVkZrd1dsUkplRTVFYkcxUFZHeG9XV3BWTUZwRVJYaFpWRmw0Q2sxVVJUVk5la3BwVFVORlIwTnBjMGRCVVZGQ1p6YzRkMEZTVVVWRmQzZFNaREk1ZVdFeVduTmlNMlJtV2tkc2VtTkhSakJaTW1kM1dFRlpTMHQzV1VJS1FrRkhSSFo2UVVKR1VWSlBSRVY0YjJSSVVuZGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbGRYUm5WYU1uQXhZbTF3Y0ZwVE1VMWhWelIyVlRKT2FBcGliWGcxVERKR2FtUkhiSFppYmsxMlkyNVdkV041T0hwT1JHTXhUa1JaTTAxNlZUQk9lVGxvWkVoU2JHSllRakJqZVRoNFRVSlpSME5wYzBkQlVWRkNDbWMzT0hkQlVsbEZRMEYzUjJOSVZtbGlSMnhxVFVaM1IwTnBjMGRCVVZGQ1p6YzRkMEZTWjBWVVozaE5ZMjFXZDJKNmNGcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnBPVlJaTWtaMVlraHJObU50Vm0xUGJrcHNXbTVOZG1GSFZtaGFTRTEyV1RJNWExcFlaM1prYWtsMVRWTXhkV05ITUhSalNFcDJaRzFXZFFwWlZ6VnFXbE14ZVZwWFRuWmtiVlo1WlZSRFFtbG5XVXRMZDFsQ1FrRklWMlZSU1VWQloxSTRRa2h2UVdWQlFqSkJUakE1VFVkeVIzaDRSWGxaZUd0bENraEtiRzVPZDB0cFUydzJORE5xZVhRdk5HVkxZMjlCZGt0bE5rOUJRVUZDYjBweFN6QnphMEZCUVZGRVFVVmpkMUpSU1doQlR6bFFWSFUxZEVSemQyRUtSbFpqVlU1b09FeHpVRkZ5YjBsbU1ua3haMHBNVEd4YVVIVTNkV292UjNaQmFVRjNRVEI1WWxSU2FrNWlWMXBaSzJaQ2VVMVdaR1ZyV2paM1ZYbEJaZ3BYYjJkbVNGUnpjbmxRTDFKc1ZFRkxRbWRuY1docmFrOVFVVkZFUVhkT2JrRkVRbXRCYWtJeE1qVTRWM0Z1VVdSelIzUm9ZemhNTm1OWmJHRkJTblZQQ2twblkwSXpTRTFNWTJSTFRuQlJMMHhyTWxSalFVdGhZMDVGWkdzMmMwcGtXV0ZvY1hWRE9FTk5SalZxUkN0S1RFaEhhSFkwYlVvd2FIcENNMlpXVG5rS1dGRlJNbGxMVmxod0wydDRNR3BNVkZORlZsaG5OaXRvY0d3emMxWkVlR2xXWm5GWE5GWTVPRGhCUFQwS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9XX19" + } + ], + "timestampVerificationData": {} + }, + "dsseEnvelope": { + "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoicGtnOm5wbS8lNDBzY2FubHkvZW5naW5lLXp4aW5nLWpzQDIuMS4wIiwiZGlnZXN0Ijp7InNoYTUxMiI6IjQ5YTdjNjNkZGY2MzE3Yjk2NjJmMWJlNDVkOTJiOGVhOTI4OWZiYjUxZDRkMzY0YTVjMWUzZTg5OWU4MjEwMWFmZDI2OGQyNmE4YWYyNWNiOGE3MzliZDRkMjEzZjIzZWE0OTlkNGNiNWIwMGU5NWZmZjZkYzdjZmNmMGQwZmRhIn19XSwicHJlZGljYXRlVHlwZSI6Imh0dHBzOi8vc2xzYS5kZXYvcHJvdmVuYW5jZS92MSIsInByZWRpY2F0ZSI6eyJidWlsZERlZmluaXRpb24iOnsiYnVpbGRUeXBlIjoiaHR0cHM6Ly9zbHNhLWZyYW1ld29yay5naXRodWIuaW8vZ2l0aHViLWFjdGlvbnMtYnVpbGR0eXBlcy93b3JrZmxvdy92MSIsImV4dGVybmFsUGFyYW1ldGVycyI6eyJ3b3JrZmxvdyI6eyJyZWYiOiJyZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkiLCJyZXBvc2l0b3J5IjoiaHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seSIsInBhdGgiOiIuZ2l0aHViL3dvcmtmbG93cy92Mi4xLWFydGlmYWN0LXF1YWxpZmljYXRpb24ueW1sIn0sInNvdXJjZV9jb21taXQiOiI2YjAxN2I1M2E0NDA0ZjRmZWFiNzc2YWMxMTFiMGVhOWRhY2YyNzM0In0sImludGVybmFsUGFyYW1ldGVycyI6eyJnaXRodWIiOnsiZXZlbnRfbmFtZSI6IndvcmtmbG93X2Rpc3BhdGNoIiwicmVwb3NpdG9yeV9pZCI6IjExNTYzNDI2NTMiLCJyZXBvc2l0b3J5X293bmVyX2lkIjoiMjI0MzcwODk4In19LCJyZXNvbHZlZERlcGVuZGVuY2llcyI6W3sidXJpIjoiZ2l0K2h0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHlAcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5IiwiZGlnZXN0Ijp7ImdpdENvbW1pdCI6ImUyMmQxMDAxNjM1NjUxNjRlMjE0OWY5OWFiNTRkMTFhNjExMTkzMmIifX0seyJ1cmkiOiJnaXQraHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seUA2YjAxN2I1M2E0NDA0ZjRmZWFiNzc2YWMxMTFiMGVhOWRhY2YyNzM0IiwiZGlnZXN0Ijp7ImdpdENvbW1pdCI6IjZiMDE3YjUzYTQ0MDRmNGZlYWI3NzZhYzExMWIwZWE5ZGFjZjI3MzQifX1dfSwicnVuRGV0YWlscyI6eyJidWlsZGVyIjp7ImlkIjoiaHR0cHM6Ly9naXRodWIuY29tL2FjdGlvbnMvcnVubmVyL2dpdGh1Yi1ob3N0ZWQifSwibWV0YWRhdGEiOnsiaW52b2NhdGlvbklkIjoiaHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seS9hY3Rpb25zL3J1bnMvMzQ3NTQ2NzM1NDcvYXR0ZW1wdHMvMSJ9fX19", + "payloadType": "application/vnd.in-toto+json", + "signatures": [ + { + "sig": "MEUCIQDs0Og2Kdf5p7wvE22MlvwOSiXFxuAhFMHUSg2KysJS6AIgcaKxrEp3L2AiDyxUSj6b3LUUGUsPEtjY/yY6pLIdSjA=" + } + ] + } +} diff --git a/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-node-2.1.0.tgz.sigstore.json b/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-node-2.1.0.tgz.sigstore.json new file mode 100644 index 0000000..fa12667 --- /dev/null +++ b/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-node-2.1.0.tgz.sigstore.json @@ -0,0 +1,62 @@ +{ + "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", + "verificationMaterial": { + "certificate": { + "rawBytes": "MIIILTCCB7OgAwIBAgIUN5eI3TLYqEI13EarWFc6qOifXBwwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTEzMTEzMjU2WhcNMjYwOTEzMTE0MjU2WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAED8PIlsctS2H6GW7IyI4Y97ljGu3SagT6buC1wArBylEiECNNGoFZ2lqOxPOpZmee7HOy3n4q07AAfZuGDrjuIqOCBtIwggbOMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUnxQEd3izswCwBbCIT3D1XlcaSGUwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wgZkGA1UdEQEB/wSBjjCBi4aBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAfBgorBgEEAYO/MAECBBF3b3JrZmxvd19kaXNwYXRjaDA2BgorBgEEAYO/MAEDBChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCkGCisGAQQBg78wAQQEG3YyLjEgQXJ0aWZhY3QgUXVhbGlmaWNhdGlvbjAjBgorBgEEAYO/MAEFBBVZYW5nanVuamllLUxpbi9TY2FubHkwOwYKKwYBBAGDvzABBgQtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTCBmgYKKwYBBAGDvzABCQSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABCgQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMB0GCisGAQQBg78wAQsEDwwNZ2l0aHViLWhvc3RlZDA4BgorBgEEAYO/MAEMBCoMKGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkwOAYKKwYBBAGDvzABDQQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMD0GCisGAQQBg78wAQ4ELwwtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MBoGCisGAQQBg78wAQ8EDAwKMTE1NjM0MjY1MzAxBgorBgEEAYO/MAEQBCMMIWh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbjAZBgorBgEEAYO/MAERBAsMCTIyNDM3MDg5ODCBmgYKKwYBBAGDvzABEgSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABEwQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCEGCisGAQQBg78wARQEEwwRd29ya2Zsb3dfZGlzcGF0Y2gwXAYKKwYBBAGDvzABFQRODExodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5L2FjdGlvbnMvcnVucy8zNDc1NDY3MzU0Ny9hdHRlbXB0cy8xMBYGCisGAQQBg78wARYECAwGcHVibGljMFwGCisGAQQBg78wARgETgxMcmVwbzpZYW5nanVuamllLUxpbi9TY2FubHk6cmVmOnJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeTCBiwYKKwYBBAHWeQIEAgR9BHsAeQB3AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABoJqKtRQAAAQDAEgwRgIhAJV3XJADty6jsR11PnCrBJvrAjF16r9e0njhProrm9nAAiEAzEBEVDJJDcht3oE1mKZ/o2UE3eH9tbimoKy8N4MVOYcwCgYIKoZIzj0EAwMDaAAwZQIxAIcCbCPkRsxbl8EFhGjJ0ZMeK1tVwyaD0P1WJykHZqqiE6hhSLp3LKjnOVu5RGctEgIwZlHYmq+Lcs90u9nA1v2Qe+F5KLapM/1emntqIUExEp5aqDvBuGp0dg23pjRXIzKw" + }, + "tlogEntries": [ + { + "logIndex": "2817434463", + "logId": { + "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=" + }, + "kindVersion": { + "kind": "dsse", + "version": "0.0.1" + }, + "integratedTime": "1789299176", + "inclusionPromise": { + "signedEntryTimestamp": "MEYCIQCLNr8h12IHRVfuC8gpCwbJC4dtDMg0AaUBNUHB8LtSdgIhAPnjUB+l3uzkWtolSidEd0lYcvWQ7kJXqeV/okARdDSn" + }, + "inclusionProof": { + "logIndex": "2695530201", + "rootHash": "9MyWeNl8L90o5TV1i+mQtcEh0UjLl9s/jpGgb3Y/89Y=", + "treeSize": "2695530211", + "hashes": [ + "iFnRkhpzW4dYag1ItoPTRnr+txfg8VzQteUol5WgsyE=", + "RHAkqk/uJvDLFLoIb78HdoDo/LbI7+tiO0XQuetbHDo=", + "THMtX+jm50rrb94fDEA2vyyVDcaZaxeF+bk/WP8QEFI=", + "mda3XqRc98VzfYsXEN1BJiXX4NauJcoriE9BklurCvA=", + "pB7KQ8nT+OYzRTxSPTYfaCZsNWnq6LfV8J2tXLNQXAo=", + "6+sGvfh8ScWuk6QaUKTbmHjKVFATLLwOUfDQrv1FW/E=", + "vHS/BmPnrMTQFUtlL6Wypj5BK7rwIjTV5IuXYYUOs6U=", + "09xWaDdKLwNFYlJwBzktGgVJASEYxGpxYrAGR/nlZrg=", + "bn0+2E2n+wV44E6BldBG+EntOjWNO2XgM3PgmMwKIT0=", + "ys1AmRgOQ1cBbTrHqVAy0aCMdqJ6C/QxHXAD9GZhxmA=", + "99PoJTYgPWevn9oVlADbWdRGR90JL8Fx/FV0T06o0IA=", + "LQtwekqXPoO3KgXYEfRsV0WYK6Gk0PLLePxJWdZgThQ=", + "qOZd1StyLttRdZ9ojwet4/yO1QqFuSN2bQKQaTXLrkY=", + "uXYCZMF7lS28YUWZqw7VfMV5vdtFS6j7/bavDJtBebk=", + "S39m2eTD1rqRuAMs4r+sGsYIwW0BlTWuysWTKJ8RKVk=", + "qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=", + "xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY=" + ], + "checkpoint": { + "envelope": "rekor.sigstore.dev - 1193050959916656506\n2695530211\n9MyWeNl8L90o5TV1i+mQtcEh0UjLl9s/jpGgb3Y/89Y=\n\n— rekor.sigstore.dev wNI9ajBFAiBHr4w+9OIieDVB7CX7Wcs7Ej2wnAaM69nWA8iDHFr8HwIhAN/q/WdX9H8sGsMeA1r2vqrMzWxDBpSzhqsn0gVImtt/\n" + } + }, + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiOTU2ZmFhOGE3ZWMxMzIzMTcyNmYxZGNmMDgwMGFhMjAwZGNjMTlkYjY1Y2JlY2FkZTJjZjY1Yzk0MDhlNzdhZSJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjNhMDk5YjkyMmYwZjFmNmY5NWJkZGE4ODQxOGFkYWMyYTFkMDJhZGM2YmI3NDk3ZjhmNmU0Yjg0N2Y0NmEzOGUifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVVQ0lCbldSRXhnTldabkhVYVNybXlJMTNWZWhtS253U0pzL3NFTk8yY08yTklRQWlFQTZVd21kTGN1QTEydm1lYVpyd0xRWVpRWU1haUVrY2VmUlM1UWtSTlpKYXc9IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VsTVZFTkRRamRQWjBGM1NVSkJaMGxWVGpWbFNUTlVURmx4UlVreE0wVmhjbGRHWXpaeFQybG1XRUozZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwOVVSWHBOVkVWNlRXcFZNbGRvWTA1TmFsbDNUMVJGZWsxVVJUQk5hbFV5VjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVkVPRkJKYkhOamRGTXlTRFpIVnpkSmVVazBXVGszYkdwSGRUTlRZV2RVTm1KMVF6RUtkMEZ5UW5sc1JXbEZRMDVPUjI5R1dqSnNjVTk0VUU5d1dtMWxaVGRJVDNremJqUnhNRGRCUVdaYWRVZEVjbXAxU1hGUFEwSjBTWGRuWjJKUFRVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVnVlRkZGQ21RemFYcHpkME4zUW1KRFNWUXpSREZZYkdOaFUwZFZkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMmRhYTBkQk1WVmtSVkZGUWk5M1UwSnFha05DYVRSaFFtbEhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RRcGhiV3hzVEZWNGNHSnBPVlJaTWtaMVlraHJka3h0WkhCa1IyZ3hXV2s1TTJJelNuSmFiWGgyWkROTmRtUnFTWFZOVXpGb1kyNVNjRnB0Um1wa1F6RjRDbVJYUm5OaFYxcHdXVEpHTUdGWE9YVk1ibXgwWWtWQ2VWcFhXbnBNTW1oc1dWZFNla3d5VG5aYVIxWTBURE5aZVV4cVJYUmlia0owVEZoQ2VXSXpXbXdLWW0xR2RWa3lWWFJqYlZacVlqTmFiR051YTNkUFVWbExTM2RaUWtKQlIwUjJla0ZDUVZGUmNtRklVakJqU0UwMlRIazVNR0l5ZEd4aWFUVm9XVE5TY0FwaU1qVjZURzFrY0dSSGFERlpibFo2V2xoS2FtSXlOVEJhVnpVd1RHMU9kbUpVUVdaQ1oyOXlRbWRGUlVGWlR5OU5RVVZEUWtKR00ySXpTbkphYlhoMkNtUXhPV3RoV0U1M1dWaFNhbUZFUVRKQ1oyOXlRbWRGUlVGWlR5OU5RVVZFUWtOb2JFMXFTbXROVkVGM1RWUlplazVVV1RGTlZGa3dXbFJKZUU1RWJHMEtUMVJzYUZscVZUQmFSRVY0V1ZSWmVFMVVSVFZOZWtwcFRVTnJSME5wYzBkQlVWRkNaemM0ZDBGUlVVVkhNMWw1VEdwRloxRllTakJoVjFwb1dUTlJad3BWV0Zab1lrZHNiV0ZYVG1oa1IyeDJZbXBCYWtKbmIzSkNaMFZGUVZsUEwwMUJSVVpDUWxaYVdWYzFibUZ1Vm5WaGJXeHNURlY0Y0dKcE9WUlpNa1oxQ21KSWEzZFBkMWxMUzNkWlFrSkJSMFIyZWtGQ1FtZFJkR050Vm0xamVUbHZXbGRHYTJONU9XcGlNbEpzWlVNNU1rMXBOSGhNVnpWM1lsTXhkMk50T1RJS1dsYzFhR0p0VG14TVdFcHNXVEk1TWxwWVNqVk5SSE5IUTJselIwRlJVVUpuTnpoM1FWRm5SVXhSZDNKaFNGSXdZMGhOTmt4NU9UQmlNblJzWW1rMWFBcFpNMUp3WWpJMWVreHRaSEJrUjJneFdXNVdlbHBZU21waU1qVXdXbGMxTUV4dFRuWmlWRU5DYldkWlMwdDNXVUpDUVVkRWRucEJRa05SVTBKcGQzbENDbWxIYURCa1NFSjZUMms0ZGxveWJEQmhTRlpwVEcxT2RtSlRPVnBaVnpWdVlXNVdkV0Z0Ykd4TVZYaHdZbWs1VkZreVJuVmlTR3QyVEcxa2NHUkhhREVLV1drNU0ySXpTbkphYlhoMlpETk5kbVJxU1hWTlV6Rm9ZMjVTY0ZwdFJtcGtRekY0WkZkR2MyRlhXbkJaTWtZd1lWYzVkVXh1YkhSaVJVSjVXbGRhZWdwTU1taHNXVmRTZWt3eVRuWmFSMVkwVEROWmVVeHFSWFJpYmtKMFRGaENlV0l6V214aWJVWjFXVEpWZEdOdFZtcGlNMXBzWTI1cmQwOUJXVXRMZDFsQ0NrSkJSMFIyZWtGQ1EyZFJjVVJEYUd4TmFrcHJUVlJCZDAxVVdYcE9WRmt4VFZSWk1GcFVTWGhPUkd4dFQxUnNhRmxxVlRCYVJFVjRXVlJaZUUxVVJUVUtUWHBLYVUxQ01FZERhWE5IUVZGUlFtYzNPSGRCVVhORlJIZDNUbG95YkRCaFNGWnBURmRvZG1NelVteGFSRUUwUW1kdmNrSm5SVVZCV1U4dlRVRkZUUXBDUTI5TlMwZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNVdsbFhOVzVoYmxaMVlXMXNiRXhWZUhCaWFUbFVXVEpHZFdKSWEzZFBRVmxMQ2t0M1dVSkNRVWRFZG5wQlFrUlJVWEZFUTJoc1RXcEthMDFVUVhkTlZGbDZUbFJaTVUxVVdUQmFWRWw0VGtSc2JVOVViR2haYWxVd1drUkZlRmxVV1hnS1RWUkZOVTE2U21sTlJEQkhRMmx6UjBGUlVVSm5OemgzUVZFMFJVeDNkM1JqYlZadFkzazViMXBYUm10amVUbHFZakpTYkdWRE9USk5hVFI0VEZjMWR3cGlVekYzWTIwNU1scFhOV2hpYlU1c1RGaEtiRmt5T1RKYVdFbzFUVUp2UjBOcGMwZEJVVkZDWnpjNGQwRlJPRVZFUVhkTFRWUkZNVTVxVFRCTmFsa3hDazE2UVhoQ1oyOXlRbWRGUlVGWlR5OU5RVVZSUWtOTlRVbFhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnFRVnBDWjI5eVFtZEZSVUZaVHk5TlFVVlNRa0Z6VFVOVVNYbE9SRTB6VFVSbk5VOUVRMEp0WjFsTFMzZFpRa0pCUjBSMmVrRkNSV2RUUWdwcGQzbENhVWRvTUdSSVFucFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVXbGxYTlc1aGJsWjFZVzFzYkV4VmVIQmlhVGxVV1RKR2RXSklhM1pNYldSd0NtUkhhREZaYVRrellqTktjbHB0ZUhaa00wMTJaR3BKZFUxVE1XaGpibEp3V20xR2FtUkRNWGhrVjBaellWZGFjRmt5UmpCaFZ6bDFURzVzZEdKRlFua0tXbGRhZWt3eWFHeFpWMUo2VERKT2RscEhWalJNTTFsNVRHcEZkR0p1UW5STVdFSjVZak5hYkdKdFJuVlpNbFYwWTIxV2FtSXpXbXhqYm10M1QwRlpTd3BMZDFsQ1FrRkhSSFo2UVVKRmQxRnhSRU5vYkUxcVNtdE5WRUYzVFZSWmVrNVVXVEZOVkZrd1dsUkplRTVFYkcxUFZHeG9XV3BWTUZwRVJYaFpWRmw0Q2sxVVJUVk5la3BwVFVORlIwTnBjMGRCVVZGQ1p6YzRkMEZTVVVWRmQzZFNaREk1ZVdFeVduTmlNMlJtV2tkc2VtTkhSakJaTW1kM1dFRlpTMHQzV1VJS1FrRkhSSFo2UVVKR1VWSlBSRVY0YjJSSVVuZGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbGRYUm5WYU1uQXhZbTF3Y0ZwVE1VMWhWelIyVlRKT2FBcGliWGcxVERKR2FtUkhiSFppYmsxMlkyNVdkV041T0hwT1JHTXhUa1JaTTAxNlZUQk9lVGxvWkVoU2JHSllRakJqZVRoNFRVSlpSME5wYzBkQlVWRkNDbWMzT0hkQlVsbEZRMEYzUjJOSVZtbGlSMnhxVFVaM1IwTnBjMGRCVVZGQ1p6YzRkMEZTWjBWVVozaE5ZMjFXZDJKNmNGcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnBPVlJaTWtaMVlraHJObU50Vm0xUGJrcHNXbTVOZG1GSFZtaGFTRTEyV1RJNWExcFlaM1prYWtsMVRWTXhkV05ITUhSalNFcDJaRzFXZFFwWlZ6VnFXbE14ZVZwWFRuWmtiVlo1WlZSRFFtbDNXVXRMZDFsQ1FrRklWMlZSU1VWQloxSTVRa2h6UVdWUlFqTkJUakE1VFVkeVIzaDRSWGxaZUd0bENraEtiRzVPZDB0cFUydzJORE5xZVhRdk5HVkxZMjlCZGt0bE5rOUJRVUZDYjBweFMzUlNVVUZCUVZGRVFVVm5kMUpuU1doQlNsWXpXRXBCUkhSNU5tb0tjMUl4TVZCdVEzSkNTblp5UVdwR01UWnlPV1V3Ym1wb1VISnZjbTA1YmtGQmFVVkJla1ZDUlZaRVNrcEVZMmgwTTI5Rk1XMUxXaTl2TWxWRk0yVklPUXAwWW1sdGIwdDVPRTQwVFZaUFdXTjNRMmRaU1V0dldrbDZhakJGUVhkTlJHRkJRWGRhVVVsNFFVbGpRMkpEVUd0U2MzaGliRGhGUm1oSGFrb3dXazFsQ2tzeGRGWjNlV0ZFTUZBeFYwcDVhMGhhY1hGcFJUWm9hRk5NY0ROTVMycHVUMVoxTlZKSFkzUkZaMGwzV214SVdXMXhLMHhqY3prd2RUbHVRVEYyTWxFS1pTdEdOVXRNWVhCTkx6RmxiVzUwY1VsVlJYaEZjRFZoY1VSMlFuVkhjREJrWnpJemNHcFNXRWw2UzNjS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9XX19" + } + ], + "timestampVerificationData": {} + }, + "dsseEnvelope": { + "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoicGtnOm5wbS8lNDBzY2FubHkvbm9kZUAyLjEuMCIsImRpZ2VzdCI6eyJzaGE1MTIiOiI4OGY0MDRjMTU5ZDQwMGE0YTAzZWZmMDAyOTRhZDIwNzZkYzE3ZGJjODRiMjUzYzMzZmM4Yjc0MmI5NzViZWNjMzVkNjAyZTlmYTUyOWZmMGNhOTFkYzYzNTE0OGE4MDc4ZDU1NjQ4ODA5NzNhNjNjNDlhMmE3YzZkMWRjMzM3ZSJ9fV0sInByZWRpY2F0ZVR5cGUiOiJodHRwczovL3Nsc2EuZGV2L3Byb3ZlbmFuY2UvdjEiLCJwcmVkaWNhdGUiOnsiYnVpbGREZWZpbml0aW9uIjp7ImJ1aWxkVHlwZSI6Imh0dHBzOi8vc2xzYS1mcmFtZXdvcmsuZ2l0aHViLmlvL2dpdGh1Yi1hY3Rpb25zLWJ1aWxkdHlwZXMvd29ya2Zsb3cvdjEiLCJleHRlcm5hbFBhcmFtZXRlcnMiOnsid29ya2Zsb3ciOnsicmVmIjoicmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5IiwicmVwb3NpdG9yeSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkiLCJwYXRoIjoiLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbCJ9LCJzb3VyY2VfY29tbWl0IjoiNmIwMTdiNTNhNDQwNGY0ZmVhYjc3NmFjMTExYjBlYTlkYWNmMjczNCJ9LCJpbnRlcm5hbFBhcmFtZXRlcnMiOnsiZ2l0aHViIjp7ImV2ZW50X25hbWUiOiJ3b3JrZmxvd19kaXNwYXRjaCIsInJlcG9zaXRvcnlfaWQiOiIxMTU2MzQyNjUzIiwicmVwb3NpdG9yeV9vd25lcl9pZCI6IjIyNDM3MDg5OCJ9fSwicmVzb2x2ZWREZXBlbmRlbmNpZXMiOlt7InVyaSI6ImdpdCtodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5QHJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeSIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiJlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiIn19LHsidXJpIjoiZ2l0K2h0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHlANmIwMTdiNTNhNDQwNGY0ZmVhYjc3NmFjMTExYjBlYTlkYWNmMjczNCIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiI2YjAxN2I1M2E0NDA0ZjRmZWFiNzc2YWMxMTFiMGVhOWRhY2YyNzM0In19XX0sInJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY3Rpb25zL3J1bm5lci9naXRodWItaG9zdGVkIn0sIm1ldGFkYXRhIjp7Imludm9jYXRpb25JZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvYWN0aW9ucy9ydW5zLzM0NzU0NjczNTQ3L2F0dGVtcHRzLzEifX19fQ==", + "payloadType": "application/vnd.in-toto+json", + "signatures": [ + { + "sig": "MEUCIBnWRExgNWZnHUaSrmyI13VehmKnwSJs/sENO2cO2NIQAiEA6UwmdLcuA12vmeaZrwLQYZQYMaiEkcefRS5QkRNZJaw=" + } + ] + } +} diff --git a/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-parsers-2.1.0.tgz.sigstore.json b/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-parsers-2.1.0.tgz.sigstore.json new file mode 100644 index 0000000..093dc34 --- /dev/null +++ b/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-parsers-2.1.0.tgz.sigstore.json @@ -0,0 +1,63 @@ +{ + "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", + "verificationMaterial": { + "certificate": { + "rawBytes": "MIIILDCCB7KgAwIBAgIUOWdq8UfHu0fb5VSjD7pYU3SCT/IwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTEzMTEzMjU3WhcNMjYwOTEzMTE0MjU3WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgbmp/16TiajWQVp+b2n99BoVwjTJDY7zlsK2rqsoUwutDmbEyZgRupP5wRuXSnT6OT4ZIAtOkNSB9o8hvxujyaOCBtEwggbNMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUK9shKzBA1xq97m1bBaTP1I0ZUy4wHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wgZkGA1UdEQEB/wSBjjCBi4aBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAfBgorBgEEAYO/MAECBBF3b3JrZmxvd19kaXNwYXRjaDA2BgorBgEEAYO/MAEDBChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCkGCisGAQQBg78wAQQEG3YyLjEgQXJ0aWZhY3QgUXVhbGlmaWNhdGlvbjAjBgorBgEEAYO/MAEFBBVZYW5nanVuamllLUxpbi9TY2FubHkwOwYKKwYBBAGDvzABBgQtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTCBmgYKKwYBBAGDvzABCQSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABCgQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMB0GCisGAQQBg78wAQsEDwwNZ2l0aHViLWhvc3RlZDA4BgorBgEEAYO/MAEMBCoMKGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkwOAYKKwYBBAGDvzABDQQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMD0GCisGAQQBg78wAQ4ELwwtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MBoGCisGAQQBg78wAQ8EDAwKMTE1NjM0MjY1MzAxBgorBgEEAYO/MAEQBCMMIWh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbjAZBgorBgEEAYO/MAERBAsMCTIyNDM3MDg5ODCBmgYKKwYBBAGDvzABEgSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABEwQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCEGCisGAQQBg78wARQEEwwRd29ya2Zsb3dfZGlzcGF0Y2gwXAYKKwYBBAGDvzABFQRODExodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5L2FjdGlvbnMvcnVucy8zNDc1NDY3MzU0Ny9hdHRlbXB0cy8xMBYGCisGAQQBg78wARYECAwGcHVibGljMFwGCisGAQQBg78wARgETgxMcmVwbzpZYW5nanVuamllLUxpbi9TY2FubHk6cmVmOnJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeTCBigYKKwYBBAHWeQIEAgR8BHoAeAB2AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABoJqKuQoAAAQDAEcwRQIhAJuKJMAEOVwCEM7fJT1K9F5CSTYRDyrQP+GEsGsCa07QAiAJM7xpTiv0XH0WK6EC+/KWoIVmeD2zPOltB6LHwvR07jAKBggqhkjOPQQDAwNoADBlAjEA5cWcLG7siExtsnUcXW8QsF1yAvZsjTRi2nxZa+cHRByAmSuFyKLEVlbZHxUFj82zAjBg1diTuCgvahbCoforCJllLpgXnJIDQjosPoONEF28mP56KJzpn8shbT30lxZhTgE=" + }, + "tlogEntries": [ + { + "logIndex": "2817434623", + "logId": { + "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=" + }, + "kindVersion": { + "kind": "dsse", + "version": "0.0.1" + }, + "integratedTime": "1789299177", + "inclusionPromise": { + "signedEntryTimestamp": "MEUCICEti8qcbTqUwp1DoO94E7I9ZFNLvk/fRRxl+yzwBuZFAiEAk1Y5JAWcCsYeW/sOGCXqUiTg6lqZpKr9knfjfs8kP4o=" + }, + "inclusionProof": { + "logIndex": "2695530361", + "rootHash": "mhEOSAeOk5hQu99bck9U1mpoF+Dkn+YAgJcW68RWGWA=", + "treeSize": "2695530413", + "hashes": [ + "vCHdtdigKwzZLC7OGnVjlkoB5+v4gnlBbao9GCiQXm8=", + "4UVBUt3xadUHtmnUQV6jOUK8p94AffOwLnJHL1acJi0=", + "DhAq2Qhi90lE9gqua0ymcMUsCUPMUs65EJZb4AmB8fU=", + "BjzyXiz6/TSu63tdUNTGxRebQqLH960oy5Xt1Dp+1uM=", + "jJl8TyKheDxwbdvTN9PO9H0wFhnmTYAKVJRpjnHhtAI=", + "qLucV6VVcsvsvPi6YqmaxG5JptKijobgk1aJkmuVLrY=", + "oJUj6URJlZpaLs2Y6YUcodZmhUA0iAc9xq4MkP5U8xU=", + "ptdnTclH3jG3tNTbLbkFcRaIslaILNeXm61Dn0cQjfc=", + "fewJLsqil/nF94u4A1y37ZfzibQy/mAWydsBp5/Kqmc=", + "bn0+2E2n+wV44E6BldBG+EntOjWNO2XgM3PgmMwKIT0=", + "ys1AmRgOQ1cBbTrHqVAy0aCMdqJ6C/QxHXAD9GZhxmA=", + "99PoJTYgPWevn9oVlADbWdRGR90JL8Fx/FV0T06o0IA=", + "LQtwekqXPoO3KgXYEfRsV0WYK6Gk0PLLePxJWdZgThQ=", + "qOZd1StyLttRdZ9ojwet4/yO1QqFuSN2bQKQaTXLrkY=", + "uXYCZMF7lS28YUWZqw7VfMV5vdtFS6j7/bavDJtBebk=", + "S39m2eTD1rqRuAMs4r+sGsYIwW0BlTWuysWTKJ8RKVk=", + "qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=", + "xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY=" + ], + "checkpoint": { + "envelope": "rekor.sigstore.dev - 1193050959916656506\n2695530413\nmhEOSAeOk5hQu99bck9U1mpoF+Dkn+YAgJcW68RWGWA=\n\n— rekor.sigstore.dev wNI9ajBFAiEAqfYhO5vq9kqgaU33THiDvg+8gvtMD5gX/l6N4k7Y3O8CIFysPoDcMHuePWYhcc/OsBBN78hmGuoD6AMJUVeXTzBv\n" + } + }, + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiZTcyMjU2ZDc2YTNiMTYzN2I5MDAyYzU0NjA3NWRhZjNjN2VkZjIyYTcwMzRmMTFhZjRhZWUxMzQ5NzIxM2VkYSJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImExOGI3NTcwMmViY2I2ODU5NzVhNzhiMWRiYzdkNTZiNjYxM2M4ODlkZTc1MTFlNzExNGQyNmUyZjI3NmUxZmYifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVRQ0lFNHFDOXJLWXczSXk5b3JXVWxCelB2RlpPbUh0YmNzMlZWRHhRSjFnYTJQQWlBRHFoQXUzUVFNTG9kU21SNnF0U08xR1o0bUZoTzhTSDQ2UFpaM3ZMbVhpdz09IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VsTVJFTkRRamRMWjBGM1NVSkJaMGxWVDFka2NUaFZaa2gxTUdaaU5WWlRha1EzY0ZsVk0xTkRWQzlKZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwOVVSWHBOVkVWNlRXcFZNMWRvWTA1TmFsbDNUMVJGZWsxVVJUQk5hbFV6VjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVm5ZbTF3THpFMlZHbGhhbGRSVm5BcllqSnVPVGxDYjFaM2FsUktSRmszZW14elN6SUtjbkZ6YjFWM2RYUkViV0pGZVZwblVuVndVRFYzVW5WWVUyNVVOazlVTkZwSlFYUlBhMDVUUWpsdk9HaDJlSFZxZVdGUFEwSjBSWGRuWjJKT1RVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVkxPWE5vQ2t0NlFrRXhlSEU1TjIweFlrSmhWRkF4U1RCYVZYazBkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMmRhYTBkQk1WVmtSVkZGUWk5M1UwSnFha05DYVRSaFFtbEhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RRcGhiV3hzVEZWNGNHSnBPVlJaTWtaMVlraHJka3h0WkhCa1IyZ3hXV2s1TTJJelNuSmFiWGgyWkROTmRtUnFTWFZOVXpGb1kyNVNjRnB0Um1wa1F6RjRDbVJYUm5OaFYxcHdXVEpHTUdGWE9YVk1ibXgwWWtWQ2VWcFhXbnBNTW1oc1dWZFNla3d5VG5aYVIxWTBURE5aZVV4cVJYUmlia0owVEZoQ2VXSXpXbXdLWW0xR2RWa3lWWFJqYlZacVlqTmFiR051YTNkUFVWbExTM2RaUWtKQlIwUjJla0ZDUVZGUmNtRklVakJqU0UwMlRIazVNR0l5ZEd4aWFUVm9XVE5TY0FwaU1qVjZURzFrY0dSSGFERlpibFo2V2xoS2FtSXlOVEJhVnpVd1RHMU9kbUpVUVdaQ1oyOXlRbWRGUlVGWlR5OU5RVVZEUWtKR00ySXpTbkphYlhoMkNtUXhPV3RoV0U1M1dWaFNhbUZFUVRKQ1oyOXlRbWRGUlVGWlR5OU5RVVZFUWtOb2JFMXFTbXROVkVGM1RWUlplazVVV1RGTlZGa3dXbFJKZUU1RWJHMEtUMVJzYUZscVZUQmFSRVY0V1ZSWmVFMVVSVFZOZWtwcFRVTnJSME5wYzBkQlVWRkNaemM0ZDBGUlVVVkhNMWw1VEdwRloxRllTakJoVjFwb1dUTlJad3BWV0Zab1lrZHNiV0ZYVG1oa1IyeDJZbXBCYWtKbmIzSkNaMFZGUVZsUEwwMUJSVVpDUWxaYVdWYzFibUZ1Vm5WaGJXeHNURlY0Y0dKcE9WUlpNa1oxQ21KSWEzZFBkMWxMUzNkWlFrSkJSMFIyZWtGQ1FtZFJkR050Vm0xamVUbHZXbGRHYTJONU9XcGlNbEpzWlVNNU1rMXBOSGhNVnpWM1lsTXhkMk50T1RJS1dsYzFhR0p0VG14TVdFcHNXVEk1TWxwWVNqVk5SSE5IUTJselIwRlJVVUpuTnpoM1FWRm5SVXhSZDNKaFNGSXdZMGhOTmt4NU9UQmlNblJzWW1rMWFBcFpNMUp3WWpJMWVreHRaSEJrUjJneFdXNVdlbHBZU21waU1qVXdXbGMxTUV4dFRuWmlWRU5DYldkWlMwdDNXVUpDUVVkRWRucEJRa05SVTBKcGQzbENDbWxIYURCa1NFSjZUMms0ZGxveWJEQmhTRlpwVEcxT2RtSlRPVnBaVnpWdVlXNVdkV0Z0Ykd4TVZYaHdZbWs1VkZreVJuVmlTR3QyVEcxa2NHUkhhREVLV1drNU0ySXpTbkphYlhoMlpETk5kbVJxU1hWTlV6Rm9ZMjVTY0ZwdFJtcGtRekY0WkZkR2MyRlhXbkJaTWtZd1lWYzVkVXh1YkhSaVJVSjVXbGRhZWdwTU1taHNXVmRTZWt3eVRuWmFSMVkwVEROWmVVeHFSWFJpYmtKMFRGaENlV0l6V214aWJVWjFXVEpWZEdOdFZtcGlNMXBzWTI1cmQwOUJXVXRMZDFsQ0NrSkJSMFIyZWtGQ1EyZFJjVVJEYUd4TmFrcHJUVlJCZDAxVVdYcE9WRmt4VFZSWk1GcFVTWGhPUkd4dFQxUnNhRmxxVlRCYVJFVjRXVlJaZUUxVVJUVUtUWHBLYVUxQ01FZERhWE5IUVZGUlFtYzNPSGRCVVhORlJIZDNUbG95YkRCaFNGWnBURmRvZG1NelVteGFSRUUwUW1kdmNrSm5SVVZCV1U4dlRVRkZUUXBDUTI5TlMwZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNVdsbFhOVzVoYmxaMVlXMXNiRXhWZUhCaWFUbFVXVEpHZFdKSWEzZFBRVmxMQ2t0M1dVSkNRVWRFZG5wQlFrUlJVWEZFUTJoc1RXcEthMDFVUVhkTlZGbDZUbFJaTVUxVVdUQmFWRWw0VGtSc2JVOVViR2haYWxVd1drUkZlRmxVV1hnS1RWUkZOVTE2U21sTlJEQkhRMmx6UjBGUlVVSm5OemgzUVZFMFJVeDNkM1JqYlZadFkzazViMXBYUm10amVUbHFZakpTYkdWRE9USk5hVFI0VEZjMWR3cGlVekYzWTIwNU1scFhOV2hpYlU1c1RGaEtiRmt5T1RKYVdFbzFUVUp2UjBOcGMwZEJVVkZDWnpjNGQwRlJPRVZFUVhkTFRWUkZNVTVxVFRCTmFsa3hDazE2UVhoQ1oyOXlRbWRGUlVGWlR5OU5RVVZSUWtOTlRVbFhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnFRVnBDWjI5eVFtZEZSVUZaVHk5TlFVVlNRa0Z6VFVOVVNYbE9SRTB6VFVSbk5VOUVRMEp0WjFsTFMzZFpRa0pCUjBSMmVrRkNSV2RUUWdwcGQzbENhVWRvTUdSSVFucFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVXbGxYTlc1aGJsWjFZVzFzYkV4VmVIQmlhVGxVV1RKR2RXSklhM1pNYldSd0NtUkhhREZaYVRrellqTktjbHB0ZUhaa00wMTJaR3BKZFUxVE1XaGpibEp3V20xR2FtUkRNWGhrVjBaellWZGFjRmt5UmpCaFZ6bDFURzVzZEdKRlFua0tXbGRhZWt3eWFHeFpWMUo2VERKT2RscEhWalJNTTFsNVRHcEZkR0p1UW5STVdFSjVZak5hYkdKdFJuVlpNbFYwWTIxV2FtSXpXbXhqYm10M1QwRlpTd3BMZDFsQ1FrRkhSSFo2UVVKRmQxRnhSRU5vYkUxcVNtdE5WRUYzVFZSWmVrNVVXVEZOVkZrd1dsUkplRTVFYkcxUFZHeG9XV3BWTUZwRVJYaFpWRmw0Q2sxVVJUVk5la3BwVFVORlIwTnBjMGRCVVZGQ1p6YzRkMEZTVVVWRmQzZFNaREk1ZVdFeVduTmlNMlJtV2tkc2VtTkhSakJaTW1kM1dFRlpTMHQzV1VJS1FrRkhSSFo2UVVKR1VWSlBSRVY0YjJSSVVuZGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbGRYUm5WYU1uQXhZbTF3Y0ZwVE1VMWhWelIyVlRKT2FBcGliWGcxVERKR2FtUkhiSFppYmsxMlkyNVdkV041T0hwT1JHTXhUa1JaTTAxNlZUQk9lVGxvWkVoU2JHSllRakJqZVRoNFRVSlpSME5wYzBkQlVWRkNDbWMzT0hkQlVsbEZRMEYzUjJOSVZtbGlSMnhxVFVaM1IwTnBjMGRCVVZGQ1p6YzRkMEZTWjBWVVozaE5ZMjFXZDJKNmNGcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnBPVlJaTWtaMVlraHJObU50Vm0xUGJrcHNXbTVOZG1GSFZtaGFTRTEyV1RJNWExcFlaM1prYWtsMVRWTXhkV05ITUhSalNFcDJaRzFXZFFwWlZ6VnFXbE14ZVZwWFRuWmtiVlo1WlZSRFFtbG5XVXRMZDFsQ1FrRklWMlZSU1VWQloxSTRRa2h2UVdWQlFqSkJUakE1VFVkeVIzaDRSWGxaZUd0bENraEtiRzVPZDB0cFUydzJORE5xZVhRdk5HVkxZMjlCZGt0bE5rOUJRVUZDYjBweFMzVlJiMEZCUVZGRVFVVmpkMUpSU1doQlNuVkxTazFCUlU5V2QwTUtSVTAzWmtwVU1VczVSalZEVTFSWlVrUjVjbEZRSzBkRmMwZHpRMkV3TjFGQmFVRktUVGQ0Y0ZScGRqQllTREJYU3paRlF5c3ZTMWR2U1ZadFpVUXllZ3BRVDJ4MFFqWk1TSGQyVWpBM2FrRkxRbWRuY1docmFrOVFVVkZFUVhkT2IwRkVRbXhCYWtWQk5XTlhZMHhITjNOcFJYaDBjMjVWWTFoWE9GRnpSakY1Q2tGMlduTnFWRkpwTW01NFdtRXJZMGhTUW5sQmJWTjFSbmxMVEVWV2JHSmFTSGhWUm1vNE1ucEJha0puTVdScFZIVkRaM1poYUdKRGIyWnZja05LYkd3S1RIQm5XRzVLU1VSUmFtOXpVRzlQVGtWR01qaHRVRFUyUzBwNmNHNDRjMmhpVkRNd2JIaGFhRlJuUlQwS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9XX19" + } + ], + "timestampVerificationData": {} + }, + "dsseEnvelope": { + "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoicGtnOm5wbS8lNDBzY2FubHkvcGFyc2Vyc0AyLjEuMCIsImRpZ2VzdCI6eyJzaGE1MTIiOiIxYWE2ODMzNDA3ZTlkMjZhZDAyYjE2MGYyNTM3OTZlNzNkOTUxN2M1YzlhYTVkNmQ2NDc5NWZjY2MzNzU5MWY0ZDE5OTdmNDQzZmY1YmEzNGYwYzA1ZmVhMzVjOWJiMjE3YjIzOTE2ZjRiMjQxOGVmMDRmMDk5YTg4YjU5NDc1NSJ9fV0sInByZWRpY2F0ZVR5cGUiOiJodHRwczovL3Nsc2EuZGV2L3Byb3ZlbmFuY2UvdjEiLCJwcmVkaWNhdGUiOnsiYnVpbGREZWZpbml0aW9uIjp7ImJ1aWxkVHlwZSI6Imh0dHBzOi8vc2xzYS1mcmFtZXdvcmsuZ2l0aHViLmlvL2dpdGh1Yi1hY3Rpb25zLWJ1aWxkdHlwZXMvd29ya2Zsb3cvdjEiLCJleHRlcm5hbFBhcmFtZXRlcnMiOnsid29ya2Zsb3ciOnsicmVmIjoicmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5IiwicmVwb3NpdG9yeSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkiLCJwYXRoIjoiLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbCJ9LCJzb3VyY2VfY29tbWl0IjoiNmIwMTdiNTNhNDQwNGY0ZmVhYjc3NmFjMTExYjBlYTlkYWNmMjczNCJ9LCJpbnRlcm5hbFBhcmFtZXRlcnMiOnsiZ2l0aHViIjp7ImV2ZW50X25hbWUiOiJ3b3JrZmxvd19kaXNwYXRjaCIsInJlcG9zaXRvcnlfaWQiOiIxMTU2MzQyNjUzIiwicmVwb3NpdG9yeV9vd25lcl9pZCI6IjIyNDM3MDg5OCJ9fSwicmVzb2x2ZWREZXBlbmRlbmNpZXMiOlt7InVyaSI6ImdpdCtodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5QHJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeSIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiJlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiIn19LHsidXJpIjoiZ2l0K2h0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHlANmIwMTdiNTNhNDQwNGY0ZmVhYjc3NmFjMTExYjBlYTlkYWNmMjczNCIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiI2YjAxN2I1M2E0NDA0ZjRmZWFiNzc2YWMxMTFiMGVhOWRhY2YyNzM0In19XX0sInJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY3Rpb25zL3J1bm5lci9naXRodWItaG9zdGVkIn0sIm1ldGFkYXRhIjp7Imludm9jYXRpb25JZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvYWN0aW9ucy9ydW5zLzM0NzU0NjczNTQ3L2F0dGVtcHRzLzEifX19fQ==", + "payloadType": "application/vnd.in-toto+json", + "signatures": [ + { + "sig": "MEQCIE4qC9rKYw3Iy9orWUlBzPvFZOmHtbcs2VVDxQJ1ga2PAiADqhAu3QQMLodSmR6qtSO1GZ4mFhO8SH46PZZ3vLmXiw==" + } + ] + } +} diff --git a/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-react-2.1.0.tgz.sigstore.json b/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-react-2.1.0.tgz.sigstore.json new file mode 100644 index 0000000..2aec5be --- /dev/null +++ b/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-react-2.1.0.tgz.sigstore.json @@ -0,0 +1,60 @@ +{ + "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", + "verificationMaterial": { + "certificate": { + "rawBytes": "MIIILTCCB7OgAwIBAgIUc52U6os5z88x7GpKUge5xyTd0rswCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTEzMTEzMjU4WhcNMjYwOTEzMTE0MjU4WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEdADK0jIOtfP6BPs3Blhd0ddlplGH4NKerbilIr5kztwD4hxnWeSnAgD2WCbUkOPrW1ExqLB5IbTTiQvwM9boqaOCBtIwggbOMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUXg3+XBIJhMpUXoo8SgLERxDpIOswHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wgZkGA1UdEQEB/wSBjjCBi4aBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAfBgorBgEEAYO/MAECBBF3b3JrZmxvd19kaXNwYXRjaDA2BgorBgEEAYO/MAEDBChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCkGCisGAQQBg78wAQQEG3YyLjEgQXJ0aWZhY3QgUXVhbGlmaWNhdGlvbjAjBgorBgEEAYO/MAEFBBVZYW5nanVuamllLUxpbi9TY2FubHkwOwYKKwYBBAGDvzABBgQtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTCBmgYKKwYBBAGDvzABCQSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABCgQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMB0GCisGAQQBg78wAQsEDwwNZ2l0aHViLWhvc3RlZDA4BgorBgEEAYO/MAEMBCoMKGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkwOAYKKwYBBAGDvzABDQQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMD0GCisGAQQBg78wAQ4ELwwtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MBoGCisGAQQBg78wAQ8EDAwKMTE1NjM0MjY1MzAxBgorBgEEAYO/MAEQBCMMIWh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbjAZBgorBgEEAYO/MAERBAsMCTIyNDM3MDg5ODCBmgYKKwYBBAGDvzABEgSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABEwQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCEGCisGAQQBg78wARQEEwwRd29ya2Zsb3dfZGlzcGF0Y2gwXAYKKwYBBAGDvzABFQRODExodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5L2FjdGlvbnMvcnVucy8zNDc1NDY3MzU0Ny9hdHRlbXB0cy8xMBYGCisGAQQBg78wARYECAwGcHVibGljMFwGCisGAQQBg78wARgETgxMcmVwbzpZYW5nanVuamllLUxpbi9TY2FubHk6cmVmOnJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeTCBiwYKKwYBBAHWeQIEAgR9BHsAeQB3AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABoJqKvagAAAQDAEgwRgIhAObwTsOrlOByus/ZGmEgk0yhIeSbVFT+SHSsv1w47JvyAiEA6ReP0EJLhJk2Mqh4se2FcufzMZXUMWF3+aPit+tiss8wCgYIKoZIzj0EAwMDaAAwZQIxAOoY64iHLftZbmgPRNuSfNkzLoTx7hrt71p8y2vrJMhaKEf9EpnYmntqKtgFW5kWwwIweJu7nPaAf15x8hA4Z7SJcINCxFMTeb/f+To0jOwV3xyREIAF8Kw5mk2+fDQMSsKz" + }, + "tlogEntries": [ + { + "logIndex": "2817434809", + "logId": { + "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=" + }, + "kindVersion": { + "kind": "dsse", + "version": "0.0.1" + }, + "integratedTime": "1789299179", + "inclusionPromise": { + "signedEntryTimestamp": "MEQCIBKol3EW8I9jUulVo1LIPEG8Jr3SnQcISxB6bRA6TfRhAiAbiVlRrk5767rvkgzWHuxLDYgaLOuAhB74JA3WtWLEEw==" + }, + "inclusionProof": { + "logIndex": "2695530547", + "rootHash": "0nhLjqvz7obYoUINy46QLuRwah5UaSdwicStiDbYsAI=", + "treeSize": "2695530564", + "hashes": [ + "efRcUFnuQgP3xCx2m5PFBBE1/81d5QJDlFGxRla2SlU=", + "Rud+4rTvm0HWsW3XvLa8gEg+wjRWEl2T9ngEPMdfPAQ=", + "s8kp0VCKAggA7PXhTRYfbzKi2kR8kqTLk1IJbP5Qpxc=", + "RP4H9Dli1+HikCtXBchCKn3PEHgLAwypnANku+ZBrKs=", + "iqNA+ZzuYl8gYMXnZkFCw5VsZ4nSn8PkfNbMF9sP7l0=", + "2saUhgQiGEbsG1VoCjLsYF8POFzTcw4oZebLbdvWgUw=", + "GTGr32yBgahzHUPCiOTAiDjDa0fFnYw53GPZ11kl3GI=", + "Y/1TNslGjlRpnPu4iExTvxSjrElc6GSAMXKXHwK2fmQ=", + "99PoJTYgPWevn9oVlADbWdRGR90JL8Fx/FV0T06o0IA=", + "LQtwekqXPoO3KgXYEfRsV0WYK6Gk0PLLePxJWdZgThQ=", + "qOZd1StyLttRdZ9ojwet4/yO1QqFuSN2bQKQaTXLrkY=", + "uXYCZMF7lS28YUWZqw7VfMV5vdtFS6j7/bavDJtBebk=", + "S39m2eTD1rqRuAMs4r+sGsYIwW0BlTWuysWTKJ8RKVk=", + "qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=", + "xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY=" + ], + "checkpoint": { + "envelope": "rekor.sigstore.dev - 1193050959916656506\n2695530564\n0nhLjqvz7obYoUINy46QLuRwah5UaSdwicStiDbYsAI=\n\n— rekor.sigstore.dev wNI9ajBGAiEAj6FRoljlki0K2DAUTSrvQ7QSG7TD0CsU/vjveUs95akCIQDYu/gIN0e0j35r0F0/Y+gOXu4+HM1xkw6MzmJkQwszeQ==\n" + } + }, + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiMDAxYzNiMWM5OTlkNmMxMDFmY2EyNmI5M2JhYTI1YWY0MWY5MzRmYWU4NDY5NjVkMDQxYTAxODYwMWQ0ZTFkMCJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjA0OGYzZjlmYjRkNGFlYjczMzY0NTNlZWZiMjY2ZDc4ZmUyYWQxNjUyYjE4MjUzNjFlOTYzMjI3OTMwZTdhNWMifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVZQ0lRQzlaaG1Wc1gzSHgvSmh6cVNQZEp5S0xyNDJYY0NTOG50V2QzZStvQ1RGWFFJaEFQYlVIZ2NtRVJWbk1xZGdpbGNTTm8yUFRGNm40aGlIeDNYbGcrNENvbkxSIiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VsTVZFTkRRamRQWjBGM1NVSkJaMGxWWXpVeVZUWnZjelY2T0RoNE4wZHdTMVZuWlRWNGVWUmtNSEp6ZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwOVVSWHBOVkVWNlRXcFZORmRvWTA1TmFsbDNUMVJGZWsxVVJUQk5hbFUwVjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVmtRVVJMTUdwSlQzUm1VRFpDVUhNelFteG9aREJrWkd4d2JFZElORTVMWlhKaWFXd0tTWEkxYTNwMGQwUTBhSGh1VjJWVGJrRm5SREpYUTJKVmEwOVFjbGN4UlhoeFRFSTFTV0pVVkdsUmRuZE5PV0p2Y1dGUFEwSjBTWGRuWjJKUFRVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVllaek1yQ2xoQ1NVcG9UWEJWV0c5dk9GTm5URVZTZUVSd1NVOXpkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMmRhYTBkQk1WVmtSVkZGUWk5M1UwSnFha05DYVRSaFFtbEhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RRcGhiV3hzVEZWNGNHSnBPVlJaTWtaMVlraHJka3h0WkhCa1IyZ3hXV2s1TTJJelNuSmFiWGgyWkROTmRtUnFTWFZOVXpGb1kyNVNjRnB0Um1wa1F6RjRDbVJYUm5OaFYxcHdXVEpHTUdGWE9YVk1ibXgwWWtWQ2VWcFhXbnBNTW1oc1dWZFNla3d5VG5aYVIxWTBURE5aZVV4cVJYUmlia0owVEZoQ2VXSXpXbXdLWW0xR2RWa3lWWFJqYlZacVlqTmFiR051YTNkUFVWbExTM2RaUWtKQlIwUjJla0ZDUVZGUmNtRklVakJqU0UwMlRIazVNR0l5ZEd4aWFUVm9XVE5TY0FwaU1qVjZURzFrY0dSSGFERlpibFo2V2xoS2FtSXlOVEJhVnpVd1RHMU9kbUpVUVdaQ1oyOXlRbWRGUlVGWlR5OU5RVVZEUWtKR00ySXpTbkphYlhoMkNtUXhPV3RoV0U1M1dWaFNhbUZFUVRKQ1oyOXlRbWRGUlVGWlR5OU5RVVZFUWtOb2JFMXFTbXROVkVGM1RWUlplazVVV1RGTlZGa3dXbFJKZUU1RWJHMEtUMVJzYUZscVZUQmFSRVY0V1ZSWmVFMVVSVFZOZWtwcFRVTnJSME5wYzBkQlVWRkNaemM0ZDBGUlVVVkhNMWw1VEdwRloxRllTakJoVjFwb1dUTlJad3BWV0Zab1lrZHNiV0ZYVG1oa1IyeDJZbXBCYWtKbmIzSkNaMFZGUVZsUEwwMUJSVVpDUWxaYVdWYzFibUZ1Vm5WaGJXeHNURlY0Y0dKcE9WUlpNa1oxQ21KSWEzZFBkMWxMUzNkWlFrSkJSMFIyZWtGQ1FtZFJkR050Vm0xamVUbHZXbGRHYTJONU9XcGlNbEpzWlVNNU1rMXBOSGhNVnpWM1lsTXhkMk50T1RJS1dsYzFhR0p0VG14TVdFcHNXVEk1TWxwWVNqVk5SSE5IUTJselIwRlJVVUpuTnpoM1FWRm5SVXhSZDNKaFNGSXdZMGhOTmt4NU9UQmlNblJzWW1rMWFBcFpNMUp3WWpJMWVreHRaSEJrUjJneFdXNVdlbHBZU21waU1qVXdXbGMxTUV4dFRuWmlWRU5DYldkWlMwdDNXVUpDUVVkRWRucEJRa05SVTBKcGQzbENDbWxIYURCa1NFSjZUMms0ZGxveWJEQmhTRlpwVEcxT2RtSlRPVnBaVnpWdVlXNVdkV0Z0Ykd4TVZYaHdZbWs1VkZreVJuVmlTR3QyVEcxa2NHUkhhREVLV1drNU0ySXpTbkphYlhoMlpETk5kbVJxU1hWTlV6Rm9ZMjVTY0ZwdFJtcGtRekY0WkZkR2MyRlhXbkJaTWtZd1lWYzVkVXh1YkhSaVJVSjVXbGRhZWdwTU1taHNXVmRTZWt3eVRuWmFSMVkwVEROWmVVeHFSWFJpYmtKMFRGaENlV0l6V214aWJVWjFXVEpWZEdOdFZtcGlNMXBzWTI1cmQwOUJXVXRMZDFsQ0NrSkJSMFIyZWtGQ1EyZFJjVVJEYUd4TmFrcHJUVlJCZDAxVVdYcE9WRmt4VFZSWk1GcFVTWGhPUkd4dFQxUnNhRmxxVlRCYVJFVjRXVlJaZUUxVVJUVUtUWHBLYVUxQ01FZERhWE5IUVZGUlFtYzNPSGRCVVhORlJIZDNUbG95YkRCaFNGWnBURmRvZG1NelVteGFSRUUwUW1kdmNrSm5SVVZCV1U4dlRVRkZUUXBDUTI5TlMwZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNVdsbFhOVzVoYmxaMVlXMXNiRXhWZUhCaWFUbFVXVEpHZFdKSWEzZFBRVmxMQ2t0M1dVSkNRVWRFZG5wQlFrUlJVWEZFUTJoc1RXcEthMDFVUVhkTlZGbDZUbFJaTVUxVVdUQmFWRWw0VGtSc2JVOVViR2haYWxVd1drUkZlRmxVV1hnS1RWUkZOVTE2U21sTlJEQkhRMmx6UjBGUlVVSm5OemgzUVZFMFJVeDNkM1JqYlZadFkzazViMXBYUm10amVUbHFZakpTYkdWRE9USk5hVFI0VEZjMWR3cGlVekYzWTIwNU1scFhOV2hpYlU1c1RGaEtiRmt5T1RKYVdFbzFUVUp2UjBOcGMwZEJVVkZDWnpjNGQwRlJPRVZFUVhkTFRWUkZNVTVxVFRCTmFsa3hDazE2UVhoQ1oyOXlRbWRGUlVGWlR5OU5RVVZSUWtOTlRVbFhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnFRVnBDWjI5eVFtZEZSVUZaVHk5TlFVVlNRa0Z6VFVOVVNYbE9SRTB6VFVSbk5VOUVRMEp0WjFsTFMzZFpRa0pCUjBSMmVrRkNSV2RUUWdwcGQzbENhVWRvTUdSSVFucFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVXbGxYTlc1aGJsWjFZVzFzYkV4VmVIQmlhVGxVV1RKR2RXSklhM1pNYldSd0NtUkhhREZaYVRrellqTktjbHB0ZUhaa00wMTJaR3BKZFUxVE1XaGpibEp3V20xR2FtUkRNWGhrVjBaellWZGFjRmt5UmpCaFZ6bDFURzVzZEdKRlFua0tXbGRhZWt3eWFHeFpWMUo2VERKT2RscEhWalJNTTFsNVRHcEZkR0p1UW5STVdFSjVZak5hYkdKdFJuVlpNbFYwWTIxV2FtSXpXbXhqYm10M1QwRlpTd3BMZDFsQ1FrRkhSSFo2UVVKRmQxRnhSRU5vYkUxcVNtdE5WRUYzVFZSWmVrNVVXVEZOVkZrd1dsUkplRTVFYkcxUFZHeG9XV3BWTUZwRVJYaFpWRmw0Q2sxVVJUVk5la3BwVFVORlIwTnBjMGRCVVZGQ1p6YzRkMEZTVVVWRmQzZFNaREk1ZVdFeVduTmlNMlJtV2tkc2VtTkhSakJaTW1kM1dFRlpTMHQzV1VJS1FrRkhSSFo2UVVKR1VWSlBSRVY0YjJSSVVuZGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbGRYUm5WYU1uQXhZbTF3Y0ZwVE1VMWhWelIyVlRKT2FBcGliWGcxVERKR2FtUkhiSFppYmsxMlkyNVdkV041T0hwT1JHTXhUa1JaTTAxNlZUQk9lVGxvWkVoU2JHSllRakJqZVRoNFRVSlpSME5wYzBkQlVWRkNDbWMzT0hkQlVsbEZRMEYzUjJOSVZtbGlSMnhxVFVaM1IwTnBjMGRCVVZGQ1p6YzRkMEZTWjBWVVozaE5ZMjFXZDJKNmNGcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnBPVlJaTWtaMVlraHJObU50Vm0xUGJrcHNXbTVOZG1GSFZtaGFTRTEyV1RJNWExcFlaM1prYWtsMVRWTXhkV05ITUhSalNFcDJaRzFXZFFwWlZ6VnFXbE14ZVZwWFRuWmtiVlo1WlZSRFFtbDNXVXRMZDFsQ1FrRklWMlZSU1VWQloxSTVRa2h6UVdWUlFqTkJUakE1VFVkeVIzaDRSWGxaZUd0bENraEtiRzVPZDB0cFUydzJORE5xZVhRdk5HVkxZMjlCZGt0bE5rOUJRVUZDYjBweFMzWmhaMEZCUVZGRVFVVm5kMUpuU1doQlQySjNWSE5QY214UFFua0tkWE12V2tkdFJXZHJNSGxvU1dWVFlsWkdWQ3RUU0ZOemRqRjNORGRLZG5sQmFVVkJObEpsVURCRlNreG9TbXN5VFhGb05ITmxNa1pqZFdaNlRWcFlWUXBOVjBZeksyRlFhWFFyZEdsemN6aDNRMmRaU1V0dldrbDZhakJGUVhkTlJHRkJRWGRhVVVsNFFVOXZXVFkwYVVoTVpuUmFZbTFuVUZKT2RWTm1UbXQ2Q2t4dlZIZzNhSEowTnpGd09Ia3lkbkpLVFdoaFMwVm1PVVZ3YmxsdGJuUnhTM1JuUmxjMWExZDNkMGwzWlVwMU4yNVFZVUZtTVRWNE9HaEJORm8zVTBvS1kwbE9RM2hHVFZSbFlpOW1LMVJ2TUdwUGQxWXplSGxTUlVsQlJqaExkelZ0YXpJclprUlJUVk56UzNvS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9XX19" + } + ], + "timestampVerificationData": {} + }, + "dsseEnvelope": { + "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoicGtnOm5wbS8lNDBzY2FubHkvcmVhY3RAMi4xLjAiLCJkaWdlc3QiOnsic2hhNTEyIjoiOGMyYjhlZTkwOGFhMDk3Y2U3YzEzMmE0ZmJkMzY3MWUxMjY0NjY1ZWQ0Y2QzNGE3ZGUzY2M1MjE4OGU4MDBhY2JkMmRkOGQyNTVjZGIxMGY3ODZiNjg2MzgzMTBkODMwMWExMWZiNmM4YzcxYjdlMDgwYmRhODg3NDFmMGE0OTcifX1dLCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9zbHNhLmRldi9wcm92ZW5hbmNlL3YxIiwicHJlZGljYXRlIjp7ImJ1aWxkRGVmaW5pdGlvbiI6eyJidWlsZFR5cGUiOiJodHRwczovL3Nsc2EtZnJhbWV3b3JrLmdpdGh1Yi5pby9naXRodWItYWN0aW9ucy1idWlsZHR5cGVzL3dvcmtmbG93L3YxIiwiZXh0ZXJuYWxQYXJhbWV0ZXJzIjp7IndvcmtmbG93Ijp7InJlZiI6InJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeSIsInJlcG9zaXRvcnkiOiJodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5IiwicGF0aCI6Ii5naXRodWIvd29ya2Zsb3dzL3YyLjEtYXJ0aWZhY3QtcXVhbGlmaWNhdGlvbi55bWwifSwic291cmNlX2NvbW1pdCI6IjZiMDE3YjUzYTQ0MDRmNGZlYWI3NzZhYzExMWIwZWE5ZGFjZjI3MzQifSwiaW50ZXJuYWxQYXJhbWV0ZXJzIjp7ImdpdGh1YiI6eyJldmVudF9uYW1lIjoid29ya2Zsb3dfZGlzcGF0Y2giLCJyZXBvc2l0b3J5X2lkIjoiMTE1NjM0MjY1MyIsInJlcG9zaXRvcnlfb3duZXJfaWQiOiIyMjQzNzA4OTgifX0sInJlc29sdmVkRGVwZW5kZW5jaWVzIjpbeyJ1cmkiOiJnaXQraHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seUByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkiLCJkaWdlc3QiOnsiZ2l0Q29tbWl0IjoiZTIyZDEwMDE2MzU2NTE2NGUyMTQ5Zjk5YWI1NGQxMWE2MTExOTMyYiJ9fSx7InVyaSI6ImdpdCtodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5QDZiMDE3YjUzYTQ0MDRmNGZlYWI3NzZhYzExMWIwZWE5ZGFjZjI3MzQiLCJkaWdlc3QiOnsiZ2l0Q29tbWl0IjoiNmIwMTdiNTNhNDQwNGY0ZmVhYjc3NmFjMTExYjBlYTlkYWNmMjczNCJ9fV19LCJydW5EZXRhaWxzIjp7ImJ1aWxkZXIiOnsiaWQiOiJodHRwczovL2dpdGh1Yi5jb20vYWN0aW9ucy9ydW5uZXIvZ2l0aHViLWhvc3RlZCJ9LCJtZXRhZGF0YSI6eyJpbnZvY2F0aW9uSWQiOiJodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5L2FjdGlvbnMvcnVucy8zNDc1NDY3MzU0Ny9hdHRlbXB0cy8xIn19fX0=", + "payloadType": "application/vnd.in-toto+json", + "signatures": [ + { + "sig": "MEYCIQC9ZhmVsX3Hx/JhzqSPdJyKLr42XcCS8ntWd3e+oCTFXQIhAPbUHgcmERVnMqdgilcSNo2PTF6n4hiHx3Xlg+4ConLR" + } + ] + } +} diff --git a/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-scenario-schema-2.1.0.tgz.sigstore.json b/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-scenario-schema-2.1.0.tgz.sigstore.json new file mode 100644 index 0000000..ce579c4 --- /dev/null +++ b/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-scenario-schema-2.1.0.tgz.sigstore.json @@ -0,0 +1,60 @@ +{ + "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", + "verificationMaterial": { + "certificate": { + "rawBytes": "MIIIKjCCB7GgAwIBAgIUXWQuZgEKqDCqL0nbtyM863ZfewMwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTEzMTEzMjU5WhcNMjYwOTEzMTE0MjU5WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEl23Dc2Fic5FKNPc9CV/5qBzsxle8KUURoy+hJPfrOqc70LGkOEqNRAJncSmsADr16G8uPh/TiaWq68TPx37sSqOCBtAwggbMMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUYmAWZn0veuwlG6ppg9zsHmlCf5kwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wgZkGA1UdEQEB/wSBjjCBi4aBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAfBgorBgEEAYO/MAECBBF3b3JrZmxvd19kaXNwYXRjaDA2BgorBgEEAYO/MAEDBChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCkGCisGAQQBg78wAQQEG3YyLjEgQXJ0aWZhY3QgUXVhbGlmaWNhdGlvbjAjBgorBgEEAYO/MAEFBBVZYW5nanVuamllLUxpbi9TY2FubHkwOwYKKwYBBAGDvzABBgQtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTCBmgYKKwYBBAGDvzABCQSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABCgQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMB0GCisGAQQBg78wAQsEDwwNZ2l0aHViLWhvc3RlZDA4BgorBgEEAYO/MAEMBCoMKGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkwOAYKKwYBBAGDvzABDQQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMD0GCisGAQQBg78wAQ4ELwwtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MBoGCisGAQQBg78wAQ8EDAwKMTE1NjM0MjY1MzAxBgorBgEEAYO/MAEQBCMMIWh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbjAZBgorBgEEAYO/MAERBAsMCTIyNDM3MDg5ODCBmgYKKwYBBAGDvzABEgSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABEwQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCEGCisGAQQBg78wARQEEwwRd29ya2Zsb3dfZGlzcGF0Y2gwXAYKKwYBBAGDvzABFQRODExodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5L2FjdGlvbnMvcnVucy8zNDc1NDY3MzU0Ny9hdHRlbXB0cy8xMBYGCisGAQQBg78wARYECAwGcHVibGljMFwGCisGAQQBg78wARgETgxMcmVwbzpZYW5nanVuamllLUxpbi9TY2FubHk6cmVmOnJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeTCBiQYKKwYBBAHWeQIEAgR7BHkAdwB1AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABoJqKwYwAAAQDAEYwRAIgCs3wOumqqm7w8K+patmeJWD6wgglImwHnwynPPy+F94CID2K99WGd2TnOGou/APzYQnyPnBFEJGZTFmv/7cLs7StMAoGCCqGSM49BAMDA2cAMGQCMACNFYyWYYnImDW7Emt94mwyGM+9n5iziJtpRjnl/Vrvu6kz/4AlQD6UYCLG8Gl5hQIwR0rNmutoJPGzFmvu76k3kSDbVmAtiRTUFYk+77GF7yg/G/vDaNQvT4XfSunEbFUi" + }, + "tlogEntries": [ + { + "logIndex": "2817434962", + "logId": { + "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=" + }, + "kindVersion": { + "kind": "dsse", + "version": "0.0.1" + }, + "integratedTime": "1789299180", + "inclusionPromise": { + "signedEntryTimestamp": "MEYCIQCN2vCFE2/BrIqZksBRAKAH/cQMWqozdcg9T2vZjq7K2gIhAMGKwYM/esM1b4PrMnKQRWoTxvyxVr5sxHe1B60VMtrZ" + }, + "inclusionProof": { + "logIndex": "2695530700", + "rootHash": "q2OVHWegJNs+IGpY9PB8h3P2YZao+Tgw9O1nbuctKjY=", + "treeSize": "2695530710", + "hashes": [ + "W2qgl5KUcsJTuRFY2l6NuXfrekX2OFKH7tLydmocP9o=", + "zHl0g8MSGLnwpmfQqTdM9pOz+35qN8C/NJq1ZZiE7vc=", + "eQD1WvjX7bYLqtP1VMl+ZboQRgI5UBGaJTiqljkoHXI=", + "VoPjxsYhaCN62gRI5dW63/0tBGStwS6c6Dl0ttcw5I8=", + "blQds6OneFpfUZI16AggKuv8NjBUWM5D+ooqE2xf0IE=", + "JyqyfgIXEdo3XlP/dB3mTwLv+72bgDwMzUCDzGbrEBg=", + "kJP2R578P0DPuI41053NRHEq5MkMWEcY5G4JRW2mf2M=", + "Y/1TNslGjlRpnPu4iExTvxSjrElc6GSAMXKXHwK2fmQ=", + "99PoJTYgPWevn9oVlADbWdRGR90JL8Fx/FV0T06o0IA=", + "LQtwekqXPoO3KgXYEfRsV0WYK6Gk0PLLePxJWdZgThQ=", + "qOZd1StyLttRdZ9ojwet4/yO1QqFuSN2bQKQaTXLrkY=", + "uXYCZMF7lS28YUWZqw7VfMV5vdtFS6j7/bavDJtBebk=", + "S39m2eTD1rqRuAMs4r+sGsYIwW0BlTWuysWTKJ8RKVk=", + "qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=", + "xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY=" + ], + "checkpoint": { + "envelope": "rekor.sigstore.dev - 1193050959916656506\n2695530710\nq2OVHWegJNs+IGpY9PB8h3P2YZao+Tgw9O1nbuctKjY=\n\n— rekor.sigstore.dev wNI9ajBFAiEAzbBdbP5knz2gRk3zqopsBMxV1pKWczDcLzPEjaLzQucCIBSDUdRxzaOXgPFcJV/6sxC6Z/K3z3B0pA1nznQt/kKx\n" + } + }, + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiYzYyMDU1ZDAxZmViMjQyMjFhMDQ2M2YxMGI3OTA5NDY0OWRkMDk5MWVjOGNkZWU4NTk5MGY2NmQwY2JkYTY0YiJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImI3MmU5MWNiM2FlOWM0OGU1NGY0MzcwZjEzMGM1MDM1NDFmZDE0MmY3MGQ2NjI2ZTA3OWM2ODc3ODE4MzEyY2YifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVVQ0lCaUJ0OTlyUVJVQ2N3Y0xpcTJENm5IdE0wTjI3MVVxNG5jbjlTWTJxOWFUQWlFQTF3MFBRMW11ZllERWVnTC81L01xNkQrT0lvUElvclBOZnpqNzNDYXMwZlU9IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VsTGFrTkRRamRIWjBGM1NVSkJaMGxWV0ZkUmRWcG5SVXR4UkVOeFREQnVZblI1VFRnMk0xcG1aWGROZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwOVVSWHBOVkVWNlRXcFZOVmRvWTA1TmFsbDNUMVJGZWsxVVJUQk5hbFUxVjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVnNNak5FWXpKR2FXTTFSa3RPVUdNNVExWXZOWEZDZW5ONGJHVTRTMVZWVW05NUsyZ0tTbEJtY2s5eFl6Y3dURWRyVDBWeFRsSkJTbTVqVTIxelFVUnlNVFpIT0hWUWFDOVVhV0ZYY1RZNFZGQjRNemR6VTNGUFEwSjBRWGRuWjJKTlRVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVlpiVUZYQ2xwdU1IWmxkWGRzUnpad2NHYzVlbk5JYld4RFpqVnJkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMmRhYTBkQk1WVmtSVkZGUWk5M1UwSnFha05DYVRSaFFtbEhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RRcGhiV3hzVEZWNGNHSnBPVlJaTWtaMVlraHJka3h0WkhCa1IyZ3hXV2s1TTJJelNuSmFiWGgyWkROTmRtUnFTWFZOVXpGb1kyNVNjRnB0Um1wa1F6RjRDbVJYUm5OaFYxcHdXVEpHTUdGWE9YVk1ibXgwWWtWQ2VWcFhXbnBNTW1oc1dWZFNla3d5VG5aYVIxWTBURE5aZVV4cVJYUmlia0owVEZoQ2VXSXpXbXdLWW0xR2RWa3lWWFJqYlZacVlqTmFiR051YTNkUFVWbExTM2RaUWtKQlIwUjJla0ZDUVZGUmNtRklVakJqU0UwMlRIazVNR0l5ZEd4aWFUVm9XVE5TY0FwaU1qVjZURzFrY0dSSGFERlpibFo2V2xoS2FtSXlOVEJhVnpVd1RHMU9kbUpVUVdaQ1oyOXlRbWRGUlVGWlR5OU5RVVZEUWtKR00ySXpTbkphYlhoMkNtUXhPV3RoV0U1M1dWaFNhbUZFUVRKQ1oyOXlRbWRGUlVGWlR5OU5RVVZFUWtOb2JFMXFTbXROVkVGM1RWUlplazVVV1RGTlZGa3dXbFJKZUU1RWJHMEtUMVJzYUZscVZUQmFSRVY0V1ZSWmVFMVVSVFZOZWtwcFRVTnJSME5wYzBkQlVWRkNaemM0ZDBGUlVVVkhNMWw1VEdwRloxRllTakJoVjFwb1dUTlJad3BWV0Zab1lrZHNiV0ZYVG1oa1IyeDJZbXBCYWtKbmIzSkNaMFZGUVZsUEwwMUJSVVpDUWxaYVdWYzFibUZ1Vm5WaGJXeHNURlY0Y0dKcE9WUlpNa1oxQ21KSWEzZFBkMWxMUzNkWlFrSkJSMFIyZWtGQ1FtZFJkR050Vm0xamVUbHZXbGRHYTJONU9XcGlNbEpzWlVNNU1rMXBOSGhNVnpWM1lsTXhkMk50T1RJS1dsYzFhR0p0VG14TVdFcHNXVEk1TWxwWVNqVk5SSE5IUTJselIwRlJVVUpuTnpoM1FWRm5SVXhSZDNKaFNGSXdZMGhOTmt4NU9UQmlNblJzWW1rMWFBcFpNMUp3WWpJMWVreHRaSEJrUjJneFdXNVdlbHBZU21waU1qVXdXbGMxTUV4dFRuWmlWRU5DYldkWlMwdDNXVUpDUVVkRWRucEJRa05SVTBKcGQzbENDbWxIYURCa1NFSjZUMms0ZGxveWJEQmhTRlpwVEcxT2RtSlRPVnBaVnpWdVlXNVdkV0Z0Ykd4TVZYaHdZbWs1VkZreVJuVmlTR3QyVEcxa2NHUkhhREVLV1drNU0ySXpTbkphYlhoMlpETk5kbVJxU1hWTlV6Rm9ZMjVTY0ZwdFJtcGtRekY0WkZkR2MyRlhXbkJaTWtZd1lWYzVkVXh1YkhSaVJVSjVXbGRhZWdwTU1taHNXVmRTZWt3eVRuWmFSMVkwVEROWmVVeHFSWFJpYmtKMFRGaENlV0l6V214aWJVWjFXVEpWZEdOdFZtcGlNMXBzWTI1cmQwOUJXVXRMZDFsQ0NrSkJSMFIyZWtGQ1EyZFJjVVJEYUd4TmFrcHJUVlJCZDAxVVdYcE9WRmt4VFZSWk1GcFVTWGhPUkd4dFQxUnNhRmxxVlRCYVJFVjRXVlJaZUUxVVJUVUtUWHBLYVUxQ01FZERhWE5IUVZGUlFtYzNPSGRCVVhORlJIZDNUbG95YkRCaFNGWnBURmRvZG1NelVteGFSRUUwUW1kdmNrSm5SVVZCV1U4dlRVRkZUUXBDUTI5TlMwZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNVdsbFhOVzVoYmxaMVlXMXNiRXhWZUhCaWFUbFVXVEpHZFdKSWEzZFBRVmxMQ2t0M1dVSkNRVWRFZG5wQlFrUlJVWEZFUTJoc1RXcEthMDFVUVhkTlZGbDZUbFJaTVUxVVdUQmFWRWw0VGtSc2JVOVViR2haYWxVd1drUkZlRmxVV1hnS1RWUkZOVTE2U21sTlJEQkhRMmx6UjBGUlVVSm5OemgzUVZFMFJVeDNkM1JqYlZadFkzazViMXBYUm10amVUbHFZakpTYkdWRE9USk5hVFI0VEZjMWR3cGlVekYzWTIwNU1scFhOV2hpYlU1c1RGaEtiRmt5T1RKYVdFbzFUVUp2UjBOcGMwZEJVVkZDWnpjNGQwRlJPRVZFUVhkTFRWUkZNVTVxVFRCTmFsa3hDazE2UVhoQ1oyOXlRbWRGUlVGWlR5OU5RVVZSUWtOTlRVbFhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnFRVnBDWjI5eVFtZEZSVUZaVHk5TlFVVlNRa0Z6VFVOVVNYbE9SRTB6VFVSbk5VOUVRMEp0WjFsTFMzZFpRa0pCUjBSMmVrRkNSV2RUUWdwcGQzbENhVWRvTUdSSVFucFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVXbGxYTlc1aGJsWjFZVzFzYkV4VmVIQmlhVGxVV1RKR2RXSklhM1pNYldSd0NtUkhhREZaYVRrellqTktjbHB0ZUhaa00wMTJaR3BKZFUxVE1XaGpibEp3V20xR2FtUkRNWGhrVjBaellWZGFjRmt5UmpCaFZ6bDFURzVzZEdKRlFua0tXbGRhZWt3eWFHeFpWMUo2VERKT2RscEhWalJNTTFsNVRHcEZkR0p1UW5STVdFSjVZak5hYkdKdFJuVlpNbFYwWTIxV2FtSXpXbXhqYm10M1QwRlpTd3BMZDFsQ1FrRkhSSFo2UVVKRmQxRnhSRU5vYkUxcVNtdE5WRUYzVFZSWmVrNVVXVEZOVkZrd1dsUkplRTVFYkcxUFZHeG9XV3BWTUZwRVJYaFpWRmw0Q2sxVVJUVk5la3BwVFVORlIwTnBjMGRCVVZGQ1p6YzRkMEZTVVVWRmQzZFNaREk1ZVdFeVduTmlNMlJtV2tkc2VtTkhSakJaTW1kM1dFRlpTMHQzV1VJS1FrRkhSSFo2UVVKR1VWSlBSRVY0YjJSSVVuZGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbGRYUm5WYU1uQXhZbTF3Y0ZwVE1VMWhWelIyVlRKT2FBcGliWGcxVERKR2FtUkhiSFppYmsxMlkyNVdkV041T0hwT1JHTXhUa1JaTTAxNlZUQk9lVGxvWkVoU2JHSllRakJqZVRoNFRVSlpSME5wYzBkQlVWRkNDbWMzT0hkQlVsbEZRMEYzUjJOSVZtbGlSMnhxVFVaM1IwTnBjMGRCVVZGQ1p6YzRkMEZTWjBWVVozaE5ZMjFXZDJKNmNGcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnBPVlJaTWtaMVlraHJObU50Vm0xUGJrcHNXbTVOZG1GSFZtaGFTRTEyV1RJNWExcFlaM1prYWtsMVRWTXhkV05ITUhSalNFcDJaRzFXZFFwWlZ6VnFXbE14ZVZwWFRuWmtiVlo1WlZSRFFtbFJXVXRMZDFsQ1FrRklWMlZSU1VWQloxSTNRa2hyUVdSM1FqRkJUakE1VFVkeVIzaDRSWGxaZUd0bENraEtiRzVPZDB0cFUydzJORE5xZVhRdk5HVkxZMjlCZGt0bE5rOUJRVUZDYjBweFMzZFpkMEZCUVZGRVFVVlpkMUpCU1dkRGN6TjNUM1Z0Y1hGdE4zY0tPRXNyY0dGMGJXVktWMFEyZDJkbmJFbHRkMGh1ZDNsdVVGQjVLMFk1TkVOSlJESkxPVGxYUjJReVZHNVBSMjkxTDBGUWVsbFJibmxRYmtKR1JVcEhXZ3BVUm0xMkx6ZGpUSE0zVTNSTlFXOUhRME54UjFOTk5EbENRVTFFUVRKalFVMUhVVU5OUVVOT1JsbDVWMWxaYmtsdFJGYzNSVzEwT1RSdGQzbEhUU3M1Q200MWFYcHBTblJ3VW1wdWJDOVdjbloxTm10Nkx6UkJiRkZFTmxWWlEweEhPRWRzTldoUlNYZFNNSEpPYlhWMGIwcFFSM3BHYlhaMU56WnJNMnRUUkdJS1ZtMUJkR2xTVkZWR1dXc3JOemRIUmpkNVp5OUhMM1pFWVU1UmRsUTBXR1pUZFc1RllrWlZhUW90TFMwdExVVk9SQ0JEUlZKVVNVWkpRMEZVUlMwdExTMHRDZz09In1dfX0=" + } + ], + "timestampVerificationData": {} + }, + "dsseEnvelope": { + "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoicGtnOm5wbS8lNDBzY2FubHkvc2NlbmFyaW8tc2NoZW1hQDIuMS4wIiwiZGlnZXN0Ijp7InNoYTUxMiI6Ijk3M2ZjM2EzODdhOTc4ZjhmNTJlNjNhODJmNTc0Y2Y4MjljMmJkZDEyYmI1YjBhZDdmNTc2NjIwNmU4NjEwMjY5ZDBlNjlhYWU5MGViNDVmNTYwZjc5NGE5MjIzZjk0MjIwMTBkNTRiYzhhNDBlODJhZTMyYzAyNzQ2OGVkZGJlIn19XSwicHJlZGljYXRlVHlwZSI6Imh0dHBzOi8vc2xzYS5kZXYvcHJvdmVuYW5jZS92MSIsInByZWRpY2F0ZSI6eyJidWlsZERlZmluaXRpb24iOnsiYnVpbGRUeXBlIjoiaHR0cHM6Ly9zbHNhLWZyYW1ld29yay5naXRodWIuaW8vZ2l0aHViLWFjdGlvbnMtYnVpbGR0eXBlcy93b3JrZmxvdy92MSIsImV4dGVybmFsUGFyYW1ldGVycyI6eyJ3b3JrZmxvdyI6eyJyZWYiOiJyZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkiLCJyZXBvc2l0b3J5IjoiaHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seSIsInBhdGgiOiIuZ2l0aHViL3dvcmtmbG93cy92Mi4xLWFydGlmYWN0LXF1YWxpZmljYXRpb24ueW1sIn0sInNvdXJjZV9jb21taXQiOiI2YjAxN2I1M2E0NDA0ZjRmZWFiNzc2YWMxMTFiMGVhOWRhY2YyNzM0In0sImludGVybmFsUGFyYW1ldGVycyI6eyJnaXRodWIiOnsiZXZlbnRfbmFtZSI6IndvcmtmbG93X2Rpc3BhdGNoIiwicmVwb3NpdG9yeV9pZCI6IjExNTYzNDI2NTMiLCJyZXBvc2l0b3J5X293bmVyX2lkIjoiMjI0MzcwODk4In19LCJyZXNvbHZlZERlcGVuZGVuY2llcyI6W3sidXJpIjoiZ2l0K2h0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHlAcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5IiwiZGlnZXN0Ijp7ImdpdENvbW1pdCI6ImUyMmQxMDAxNjM1NjUxNjRlMjE0OWY5OWFiNTRkMTFhNjExMTkzMmIifX0seyJ1cmkiOiJnaXQraHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seUA2YjAxN2I1M2E0NDA0ZjRmZWFiNzc2YWMxMTFiMGVhOWRhY2YyNzM0IiwiZGlnZXN0Ijp7ImdpdENvbW1pdCI6IjZiMDE3YjUzYTQ0MDRmNGZlYWI3NzZhYzExMWIwZWE5ZGFjZjI3MzQifX1dfSwicnVuRGV0YWlscyI6eyJidWlsZGVyIjp7ImlkIjoiaHR0cHM6Ly9naXRodWIuY29tL2FjdGlvbnMvcnVubmVyL2dpdGh1Yi1ob3N0ZWQifSwibWV0YWRhdGEiOnsiaW52b2NhdGlvbklkIjoiaHR0cHM6Ly9naXRodWIuY29tL1lhbmdqdW5qaWUtTGluL1NjYW5seS9hY3Rpb25zL3J1bnMvMzQ3NTQ2NzM1NDcvYXR0ZW1wdHMvMSJ9fX19", + "payloadType": "application/vnd.in-toto+json", + "signatures": [ + { + "sig": "MEUCIBiBt99rQRUCcwcLiq2D6nHtM0N271Uq4ncn9SY2q9aTAiEA1w0PQ1mufYDEegL/5/Mq6D+OIoPIorPNfzj73Cas0fU=" + } + ] + } +} diff --git a/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-url-safety-2.1.0.tgz.sigstore.json b/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-url-safety-2.1.0.tgz.sigstore.json new file mode 100644 index 0000000..1216980 --- /dev/null +++ b/release/stable/v2.1.0/publication-recovery/provenance-B/scanly-url-safety-2.1.0.tgz.sigstore.json @@ -0,0 +1,62 @@ +{ + "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", + "verificationMaterial": { + "certificate": { + "rawBytes": "MIIILDCCB7KgAwIBAgIULrrO/8POEK1b7oqVzL4TJpd9hM0wCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwOTEzMTEzMzAwWhcNMjYwOTEzMTE0MzAwWjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEQRjiCP5ElhMIKHqzIexySkwzkPP9lua/y9cEEBWUhqviFYSwh4tYTMB1mbKNBto3R/Bz89qHe+5VC408+/KQjaOCBtEwggbNMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUzRFaFScw/tWexxQZ8+Wwxs7esCIwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wgZkGA1UdEQEB/wSBjjCBi4aBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAfBgorBgEEAYO/MAECBBF3b3JrZmxvd19kaXNwYXRjaDA2BgorBgEEAYO/MAEDBChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCkGCisGAQQBg78wAQQEG3YyLjEgQXJ0aWZhY3QgUXVhbGlmaWNhdGlvbjAjBgorBgEEAYO/MAEFBBVZYW5nanVuamllLUxpbi9TY2FubHkwOwYKKwYBBAGDvzABBgQtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTCBmgYKKwYBBAGDvzABCQSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABCgQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMB0GCisGAQQBg78wAQsEDwwNZ2l0aHViLWhvc3RlZDA4BgorBgEEAYO/MAEMBCoMKGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkwOAYKKwYBBAGDvzABDQQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMD0GCisGAQQBg78wAQ4ELwwtcmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5MBoGCisGAQQBg78wAQ8EDAwKMTE1NjM0MjY1MzAxBgorBgEEAYO/MAEQBCMMIWh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbjAZBgorBgEEAYO/MAERBAsMCTIyNDM3MDg5ODCBmgYKKwYBBAGDvzABEgSBiwyBiGh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbEByZWZzL2hlYWRzL2NvZGV4L3YyLjEtbnBtLXByb3ZlbmFuY2UtcmVjb3ZlcnkwOAYKKwYBBAGDvzABEwQqDChlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiMCEGCisGAQQBg78wARQEEwwRd29ya2Zsb3dfZGlzcGF0Y2gwXAYKKwYBBAGDvzABFQRODExodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5L2FjdGlvbnMvcnVucy8zNDc1NDY3MzU0Ny9hdHRlbXB0cy8xMBYGCisGAQQBg78wARYECAwGcHVibGljMFwGCisGAQQBg78wARgETgxMcmVwbzpZYW5nanVuamllLUxpbi9TY2FubHk6cmVmOnJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeTCBigYKKwYBBAHWeQIEAgR8BHoAeAB2AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABoJqKxcwAAAQDAEcwRQIhAKjtrFnhv8ccjLIvAQMmY2jKgpocp2IQLL+l5C87JESQAiA7dfXjRN8ZGS6o3JMHLx3DwqfuyUnrRn26YgQ1S3cW6TAKBggqhkjOPQQDAwNoADBlAjBFHab8RkeYW168b7s/jwne4tLQl7o+Z3DbZE3mjah6F75mTzT7ZigNAX6tpzni8XUCMQDjX6gWxfEO0lG7IBOU/2S56Vp/6Z9oHXxQQjIBShiQ2EfwSA5UhJGwFQS2J8vUBwM=" + }, + "tlogEntries": [ + { + "logIndex": "2817435137", + "logId": { + "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=" + }, + "kindVersion": { + "kind": "dsse", + "version": "0.0.1" + }, + "integratedTime": "1789299181", + "inclusionPromise": { + "signedEntryTimestamp": "MEQCIAbsOmLb44JruC8JZ02raqLtXH8EJujomXfsn78VCI88AiBnQmeQm+zen61Q+TNiZPA/TnEgGlADb7Y9x0zI+lqZTA==" + }, + "inclusionProof": { + "logIndex": "2695530875", + "rootHash": "fyUoSiw/V82Q56C/+oASEWDo/LrEIpWoyA//YhFztN0=", + "treeSize": "2695530915", + "hashes": [ + "KNMkrMfM8/EKmz/dJFTCM+Ivgse2z/KxPhnUksyrrSg=", + "JtPFjEP/iYO2SJ2y8xmJjrDSHYt2T9rNIqtIPbHNSV0=", + "hK8XdI1E5d+ei4FtzItreKhbjmqyLPQ7fzaUTW34q7I=", + "Leu4ibH/j4/dWf3TbmYiXqMELWRdt4ja3L3iVQgDKTA=", + "4g5Z/82Q8rcn9uOW6mZmW9hqbk0KHie4BJrRy27ZgxY=", + "8hKRenrnBUq+D9TWRdlcKZI4OA39w3NRFQlw2WUSbHs=", + "4Vvs1igAS2olcd4r2pLd8IfPL16ltju6yGuzPJ4yeC8=", + "wQdGT6Do7Uv6tmLF+2MQVs0vxiGqI50WxcxdiuuFlJg=", + "DMOmQ6hlwjtRUNUHBYY5wuPzLTk8u1ijhY63vWSsx5M=", + "Y/1TNslGjlRpnPu4iExTvxSjrElc6GSAMXKXHwK2fmQ=", + "99PoJTYgPWevn9oVlADbWdRGR90JL8Fx/FV0T06o0IA=", + "LQtwekqXPoO3KgXYEfRsV0WYK6Gk0PLLePxJWdZgThQ=", + "qOZd1StyLttRdZ9ojwet4/yO1QqFuSN2bQKQaTXLrkY=", + "uXYCZMF7lS28YUWZqw7VfMV5vdtFS6j7/bavDJtBebk=", + "S39m2eTD1rqRuAMs4r+sGsYIwW0BlTWuysWTKJ8RKVk=", + "qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=", + "xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY=" + ], + "checkpoint": { + "envelope": "rekor.sigstore.dev - 1193050959916656506\n2695530915\nfyUoSiw/V82Q56C/+oASEWDo/LrEIpWoyA//YhFztN0=\n\n— rekor.sigstore.dev wNI9ajBGAiEAxSjs3WTlijo+QPRKqXjlQ91jAwtq3ddR9RS6CFV0c/MCIQDKJkKn6oMo7G8EnzI9PrkcpwCCzYRNAxRDFgpz7ujtbA==\n" + } + }, + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiZmQ5ZjVmY2M4OWYyMjkxOTRhMWM4ZmZiMWFhZGEyZWIzOWJjNTNkOTEyODEwMzkwYWQ5MWJlMDNhYmZiOTBlYSJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjZjNDViZGQxMDQ2Nzg1NDJkZTE3ZjdmOGNkNWM0ZjlhM2RhN2ZmZGY4YWE1MGYzNzViZDY4YTc2ZGE5ODA1NjQifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVVQ0lRRFh1YlEyOGQ5MmNrSTRVVWRLTHpheXUzYzhvK0ZXM2tGeHcvckUwYTRkVVFJZ1FLeUhYeGpkbUJKb01aRWU0dDQ3NWhPNHFQa09GVzgyMU81WVR6cnlxbEE9IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VsTVJFTkRRamRMWjBGM1NVSkJaMGxWVEhKeVR5ODRVRTlGU3pGaU4yOXhWbnBNTkZSS2NHUTVhRTB3ZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwOVVSWHBOVkVWNlRYcEJkMWRvWTA1TmFsbDNUMVJGZWsxVVJUQk5la0YzVjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVlJVbXBwUTFBMVJXeG9UVWxMU0hGNlNXVjRlVk5yZDNwclVGQTViSFZoTDNrNVkwVUtSVUpYVldoeGRtbEdXVk4zYURSMFdWUk5RakZ0WWt0T1FuUnZNMUl2UW5vNE9YRklaU3MxVmtNME1EZ3JMMHRSYW1GUFEwSjBSWGRuWjJKT1RVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVjZVa1poQ2taVFkzY3ZkRmRsZUhoUldqZ3JWM2Q0Y3pkbGMwTkpkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMmRhYTBkQk1WVmtSVkZGUWk5M1UwSnFha05DYVRSaFFtbEhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RRcGhiV3hzVEZWNGNHSnBPVlJaTWtaMVlraHJka3h0WkhCa1IyZ3hXV2s1TTJJelNuSmFiWGgyWkROTmRtUnFTWFZOVXpGb1kyNVNjRnB0Um1wa1F6RjRDbVJYUm5OaFYxcHdXVEpHTUdGWE9YVk1ibXgwWWtWQ2VWcFhXbnBNTW1oc1dWZFNla3d5VG5aYVIxWTBURE5aZVV4cVJYUmlia0owVEZoQ2VXSXpXbXdLWW0xR2RWa3lWWFJqYlZacVlqTmFiR051YTNkUFVWbExTM2RaUWtKQlIwUjJla0ZDUVZGUmNtRklVakJqU0UwMlRIazVNR0l5ZEd4aWFUVm9XVE5TY0FwaU1qVjZURzFrY0dSSGFERlpibFo2V2xoS2FtSXlOVEJhVnpVd1RHMU9kbUpVUVdaQ1oyOXlRbWRGUlVGWlR5OU5RVVZEUWtKR00ySXpTbkphYlhoMkNtUXhPV3RoV0U1M1dWaFNhbUZFUVRKQ1oyOXlRbWRGUlVGWlR5OU5RVVZFUWtOb2JFMXFTbXROVkVGM1RWUlplazVVV1RGTlZGa3dXbFJKZUU1RWJHMEtUMVJzYUZscVZUQmFSRVY0V1ZSWmVFMVVSVFZOZWtwcFRVTnJSME5wYzBkQlVWRkNaemM0ZDBGUlVVVkhNMWw1VEdwRloxRllTakJoVjFwb1dUTlJad3BWV0Zab1lrZHNiV0ZYVG1oa1IyeDJZbXBCYWtKbmIzSkNaMFZGUVZsUEwwMUJSVVpDUWxaYVdWYzFibUZ1Vm5WaGJXeHNURlY0Y0dKcE9WUlpNa1oxQ21KSWEzZFBkMWxMUzNkWlFrSkJSMFIyZWtGQ1FtZFJkR050Vm0xamVUbHZXbGRHYTJONU9XcGlNbEpzWlVNNU1rMXBOSGhNVnpWM1lsTXhkMk50T1RJS1dsYzFhR0p0VG14TVdFcHNXVEk1TWxwWVNqVk5SSE5IUTJselIwRlJVVUpuTnpoM1FWRm5SVXhSZDNKaFNGSXdZMGhOTmt4NU9UQmlNblJzWW1rMWFBcFpNMUp3WWpJMWVreHRaSEJrUjJneFdXNVdlbHBZU21waU1qVXdXbGMxTUV4dFRuWmlWRU5DYldkWlMwdDNXVUpDUVVkRWRucEJRa05SVTBKcGQzbENDbWxIYURCa1NFSjZUMms0ZGxveWJEQmhTRlpwVEcxT2RtSlRPVnBaVnpWdVlXNVdkV0Z0Ykd4TVZYaHdZbWs1VkZreVJuVmlTR3QyVEcxa2NHUkhhREVLV1drNU0ySXpTbkphYlhoMlpETk5kbVJxU1hWTlV6Rm9ZMjVTY0ZwdFJtcGtRekY0WkZkR2MyRlhXbkJaTWtZd1lWYzVkVXh1YkhSaVJVSjVXbGRhZWdwTU1taHNXVmRTZWt3eVRuWmFSMVkwVEROWmVVeHFSWFJpYmtKMFRGaENlV0l6V214aWJVWjFXVEpWZEdOdFZtcGlNMXBzWTI1cmQwOUJXVXRMZDFsQ0NrSkJSMFIyZWtGQ1EyZFJjVVJEYUd4TmFrcHJUVlJCZDAxVVdYcE9WRmt4VFZSWk1GcFVTWGhPUkd4dFQxUnNhRmxxVlRCYVJFVjRXVlJaZUUxVVJUVUtUWHBLYVUxQ01FZERhWE5IUVZGUlFtYzNPSGRCVVhORlJIZDNUbG95YkRCaFNGWnBURmRvZG1NelVteGFSRUUwUW1kdmNrSm5SVVZCV1U4dlRVRkZUUXBDUTI5TlMwZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNVdsbFhOVzVoYmxaMVlXMXNiRXhWZUhCaWFUbFVXVEpHZFdKSWEzZFBRVmxMQ2t0M1dVSkNRVWRFZG5wQlFrUlJVWEZFUTJoc1RXcEthMDFVUVhkTlZGbDZUbFJaTVUxVVdUQmFWRWw0VGtSc2JVOVViR2haYWxVd1drUkZlRmxVV1hnS1RWUkZOVTE2U21sTlJEQkhRMmx6UjBGUlVVSm5OemgzUVZFMFJVeDNkM1JqYlZadFkzazViMXBYUm10amVUbHFZakpTYkdWRE9USk5hVFI0VEZjMWR3cGlVekYzWTIwNU1scFhOV2hpYlU1c1RGaEtiRmt5T1RKYVdFbzFUVUp2UjBOcGMwZEJVVkZDWnpjNGQwRlJPRVZFUVhkTFRWUkZNVTVxVFRCTmFsa3hDazE2UVhoQ1oyOXlRbWRGUlVGWlR5OU5RVVZSUWtOTlRVbFhhREJrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9WcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnFRVnBDWjI5eVFtZEZSVUZaVHk5TlFVVlNRa0Z6VFVOVVNYbE9SRTB6VFVSbk5VOUVRMEp0WjFsTFMzZFpRa0pCUjBSMmVrRkNSV2RUUWdwcGQzbENhVWRvTUdSSVFucFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVXbGxYTlc1aGJsWjFZVzFzYkV4VmVIQmlhVGxVV1RKR2RXSklhM1pNYldSd0NtUkhhREZaYVRrellqTktjbHB0ZUhaa00wMTJaR3BKZFUxVE1XaGpibEp3V20xR2FtUkRNWGhrVjBaellWZGFjRmt5UmpCaFZ6bDFURzVzZEdKRlFua0tXbGRhZWt3eWFHeFpWMUo2VERKT2RscEhWalJNTTFsNVRHcEZkR0p1UW5STVdFSjVZak5hYkdKdFJuVlpNbFYwWTIxV2FtSXpXbXhqYm10M1QwRlpTd3BMZDFsQ1FrRkhSSFo2UVVKRmQxRnhSRU5vYkUxcVNtdE5WRUYzVFZSWmVrNVVXVEZOVkZrd1dsUkplRTVFYkcxUFZHeG9XV3BWTUZwRVJYaFpWRmw0Q2sxVVJUVk5la3BwVFVORlIwTnBjMGRCVVZGQ1p6YzRkMEZTVVVWRmQzZFNaREk1ZVdFeVduTmlNMlJtV2tkc2VtTkhSakJaTW1kM1dFRlpTMHQzV1VJS1FrRkhSSFo2UVVKR1VWSlBSRVY0YjJSSVVuZGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbGRYUm5WYU1uQXhZbTF3Y0ZwVE1VMWhWelIyVlRKT2FBcGliWGcxVERKR2FtUkhiSFppYmsxMlkyNVdkV041T0hwT1JHTXhUa1JaTTAxNlZUQk9lVGxvWkVoU2JHSllRakJqZVRoNFRVSlpSME5wYzBkQlVWRkNDbWMzT0hkQlVsbEZRMEYzUjJOSVZtbGlSMnhxVFVaM1IwTnBjMGRCVVZGQ1p6YzRkMEZTWjBWVVozaE5ZMjFXZDJKNmNGcFpWelZ1WVc1V2RXRnRiR3dLVEZWNGNHSnBPVlJaTWtaMVlraHJObU50Vm0xUGJrcHNXbTVOZG1GSFZtaGFTRTEyV1RJNWExcFlaM1prYWtsMVRWTXhkV05ITUhSalNFcDJaRzFXZFFwWlZ6VnFXbE14ZVZwWFRuWmtiVlo1WlZSRFFtbG5XVXRMZDFsQ1FrRklWMlZSU1VWQloxSTRRa2h2UVdWQlFqSkJUakE1VFVkeVIzaDRSWGxaZUd0bENraEtiRzVPZDB0cFUydzJORE5xZVhRdk5HVkxZMjlCZGt0bE5rOUJRVUZDYjBweFMzaGpkMEZCUVZGRVFVVmpkMUpSU1doQlMycDBja1p1YUhZNFkyTUtha3hKZGtGUlRXMVpNbXBMWjNCdlkzQXlTVkZNVEN0c05VTTROMHBGVTFGQmFVRTNaR1pZYWxKT09GcEhVelp2TTBwTlNFeDRNMFIzY1daMWVWVnVjZ3BTYmpJMldXZFJNVk16WTFjMlZFRkxRbWRuY1docmFrOVFVVkZFUVhkT2IwRkVRbXhCYWtKR1NHRmlPRkpyWlZsWE1UWTRZamR6TDJwM2JtVTBkRXhSQ213M2J5dGFNMFJpV2tVemJXcGhhRFpHTnpWdFZIcFVOMXBwWjA1QldEWjBjSHB1YVRoWVZVTk5VVVJxV0RablYzaG1SVTh3YkVjM1NVSlBWUzh5VXpVS05sWndMelphT1c5SVdIaFJVV3BKUWxOb2FWRXlSV1ozVTBFMVZXaEtSM2RHVVZNeVNqaDJWVUozVFQwS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9XX19" + } + ], + "timestampVerificationData": {} + }, + "dsseEnvelope": { + "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoicGtnOm5wbS8lNDBzY2FubHkvdXJsLXNhZmV0eUAyLjEuMCIsImRpZ2VzdCI6eyJzaGE1MTIiOiIyNjllMmYyZWQ3ZGJiNzE5MjZiMWVhZjMzZTA2ZGY4ZWQxN2NmMWEwYWExNmI3NDEyNTJmYTJjNTlhMzkyOTU4OGQ3NTQ5ZTVhYTY2NTVkMTQyYmZmMWIxOTgwM2RiOGFkNWJmMzk0OTU2MmRmNGQ2NWViYTUzYTg0ZDUzMWM1ZSJ9fV0sInByZWRpY2F0ZVR5cGUiOiJodHRwczovL3Nsc2EuZGV2L3Byb3ZlbmFuY2UvdjEiLCJwcmVkaWNhdGUiOnsiYnVpbGREZWZpbml0aW9uIjp7ImJ1aWxkVHlwZSI6Imh0dHBzOi8vc2xzYS1mcmFtZXdvcmsuZ2l0aHViLmlvL2dpdGh1Yi1hY3Rpb25zLWJ1aWxkdHlwZXMvd29ya2Zsb3cvdjEiLCJleHRlcm5hbFBhcmFtZXRlcnMiOnsid29ya2Zsb3ciOnsicmVmIjoicmVmcy9oZWFkcy9jb2RleC92Mi4xLW5wbS1wcm92ZW5hbmNlLXJlY292ZXJ5IiwicmVwb3NpdG9yeSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkiLCJwYXRoIjoiLmdpdGh1Yi93b3JrZmxvd3MvdjIuMS1hcnRpZmFjdC1xdWFsaWZpY2F0aW9uLnltbCJ9LCJzb3VyY2VfY29tbWl0IjoiNmIwMTdiNTNhNDQwNGY0ZmVhYjc3NmFjMTExYjBlYTlkYWNmMjczNCJ9LCJpbnRlcm5hbFBhcmFtZXRlcnMiOnsiZ2l0aHViIjp7ImV2ZW50X25hbWUiOiJ3b3JrZmxvd19kaXNwYXRjaCIsInJlcG9zaXRvcnlfaWQiOiIxMTU2MzQyNjUzIiwicmVwb3NpdG9yeV9vd25lcl9pZCI6IjIyNDM3MDg5OCJ9fSwicmVzb2x2ZWREZXBlbmRlbmNpZXMiOlt7InVyaSI6ImdpdCtodHRwczovL2dpdGh1Yi5jb20vWWFuZ2p1bmppZS1MaW4vU2Nhbmx5QHJlZnMvaGVhZHMvY29kZXgvdjIuMS1ucG0tcHJvdmVuYW5jZS1yZWNvdmVyeSIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiJlMjJkMTAwMTYzNTY1MTY0ZTIxNDlmOTlhYjU0ZDExYTYxMTE5MzJiIn19LHsidXJpIjoiZ2l0K2h0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHlANmIwMTdiNTNhNDQwNGY0ZmVhYjc3NmFjMTExYjBlYTlkYWNmMjczNCIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiI2YjAxN2I1M2E0NDA0ZjRmZWFiNzc2YWMxMTFiMGVhOWRhY2YyNzM0In19XX0sInJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY3Rpb25zL3J1bm5lci9naXRodWItaG9zdGVkIn0sIm1ldGFkYXRhIjp7Imludm9jYXRpb25JZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nanVuamllLUxpbi9TY2FubHkvYWN0aW9ucy9ydW5zLzM0NzU0NjczNTQ3L2F0dGVtcHRzLzEifX19fQ==", + "payloadType": "application/vnd.in-toto+json", + "signatures": [ + { + "sig": "MEUCIQDXubQ28d92ckI4UUdKLzayu3c8o+FW3kFxw/rE0a4dUQIgQKyHXxjdmBJoMZEe4t475hO4qPkOFW821O5YTzryqlA=" + } + ] + } +} diff --git a/release/stable/v2.1.0/publication-recovery/qualification-run.json b/release/stable/v2.1.0/publication-recovery/qualification-run.json new file mode 100644 index 0000000..5605f11 --- /dev/null +++ b/release/stable/v2.1.0/publication-recovery/qualification-run.json @@ -0,0 +1,241 @@ +{ + "conclusion": "success", + "databaseId": 34754673547, + "event": "workflow_dispatch", + "headSha": "e22d100163565164e2149f99ab54d11a6111932b", + "jobs": [ + { + "completedAt": "2026-09-13T11:33:00Z", + "conclusion": "success", + "databaseId": 103716927432, + "name": "Clean npm build A", + "startedAt": "2026-09-13T11:31:51Z", + "status": "completed", + "steps": [ + { + "completedAt": "2026-09-13T11:31:53Z", + "conclusion": "success", + "name": "Set up job", + "number": 1, + "startedAt": "2026-09-13T11:31:52Z", + "status": "completed" + }, + { + "completedAt": "2026-09-13T11:31:55Z", + "conclusion": "success", + "name": "Run actions/checkout@v4", + "number": 2, + "startedAt": "2026-09-13T11:31:53Z", + "status": "completed" + }, + { + "completedAt": "2026-09-13T11:31:58Z", + "conclusion": "success", + "name": "Run actions/checkout@v4", + "number": 3, + "startedAt": "2026-09-13T11:31:55Z", + "status": "completed" + }, + { + "completedAt": "2026-09-13T11:31:58Z", + "conclusion": "success", + "name": "Run actions/setup-node@v7", + "number": 4, + "startedAt": "2026-09-13T11:31:58Z", + "status": "completed" + }, + { + "completedAt": "2026-09-13T11:32:02Z", + "conclusion": "success", + "name": "Install pinned npm", + "number": 5, + "startedAt": "2026-09-13T11:31:58Z", + "status": "completed" + }, + { + "completedAt": "2026-09-13T11:32:14Z", + "conclusion": "success", + "name": "Verify source identity and install without dependency cache", + "number": 6, + "startedAt": "2026-09-13T11:32:02Z", + "status": "completed" + }, + { + "completedAt": "2026-09-13T11:32:44Z", + "conclusion": "success", + "name": "Build and verify public packages", + "number": 7, + "startedAt": "2026-09-13T11:32:14Z", + "status": "completed" + }, + { + "completedAt": "2026-09-13T11:32:56Z", + "conclusion": "success", + "name": "Pack exact artifacts and sign detached provenance (no publication)", + "number": 8, + "startedAt": "2026-09-13T11:32:44Z", + "status": "completed" + }, + { + "completedAt": "2026-09-13T11:32:57Z", + "conclusion": "success", + "name": "Run actions/upload-artifact@v4", + "number": 9, + "startedAt": "2026-09-13T11:32:56Z", + "status": "completed" + }, + { + "completedAt": "2026-09-13T11:32:57Z", + "conclusion": "success", + "name": "Post Run actions/setup-node@v7", + "number": 16, + "startedAt": "2026-09-13T11:32:57Z", + "status": "completed" + }, + { + "completedAt": "2026-09-13T11:32:57Z", + "conclusion": "success", + "name": "Post Run actions/checkout@v4", + "number": 17, + "startedAt": "2026-09-13T11:32:57Z", + "status": "completed" + }, + { + "completedAt": "2026-09-13T11:32:58Z", + "conclusion": "success", + "name": "Post Run actions/checkout@v4", + "number": 18, + "startedAt": "2026-09-13T11:32:57Z", + "status": "completed" + }, + { + "completedAt": "2026-09-13T11:32:58Z", + "conclusion": "success", + "name": "Complete job", + "number": 19, + "startedAt": "2026-09-13T11:32:58Z", + "status": "completed" + } + ], + "url": "https://github.com/Yangjunjie-Lin/Scanly/actions/runs/34754673547/job/103716927432" + }, + { + "completedAt": "2026-09-13T11:33:09Z", + "conclusion": "success", + "databaseId": 103716927540, + "name": "Clean npm build B", + "startedAt": "2026-09-13T11:31:52Z", + "status": "completed", + "steps": [ + { + "completedAt": "2026-09-13T11:31:54Z", + "conclusion": "success", + "name": "Set up job", + "number": 1, + "startedAt": "2026-09-13T11:31:53Z", + "status": "completed" + }, + { + "completedAt": "2026-09-13T11:31:56Z", + "conclusion": "success", + "name": "Run actions/checkout@v4", + "number": 2, + "startedAt": "2026-09-13T11:31:54Z", + "status": "completed" + }, + { + "completedAt": "2026-09-13T11:31:58Z", + "conclusion": "success", + "name": "Run actions/checkout@v4", + "number": 3, + "startedAt": "2026-09-13T11:31:56Z", + "status": "completed" + }, + { + "completedAt": "2026-09-13T11:31:58Z", + "conclusion": "success", + "name": "Run actions/setup-node@v7", + "number": 4, + "startedAt": "2026-09-13T11:31:58Z", + "status": "completed" + }, + { + "completedAt": "2026-09-13T11:32:03Z", + "conclusion": "success", + "name": "Install pinned npm", + "number": 5, + "startedAt": "2026-09-13T11:31:58Z", + "status": "completed" + }, + { + "completedAt": "2026-09-13T11:32:17Z", + "conclusion": "success", + "name": "Verify source identity and install without dependency cache", + "number": 6, + "startedAt": "2026-09-13T11:32:03Z", + "status": "completed" + }, + { + "completedAt": "2026-09-13T11:32:52Z", + "conclusion": "success", + "name": "Build and verify public packages", + "number": 7, + "startedAt": "2026-09-13T11:32:17Z", + "status": "completed" + }, + { + "completedAt": "2026-09-13T11:33:05Z", + "conclusion": "success", + "name": "Pack exact artifacts and sign detached provenance (no publication)", + "number": 8, + "startedAt": "2026-09-13T11:32:52Z", + "status": "completed" + }, + { + "completedAt": "2026-09-13T11:33:06Z", + "conclusion": "success", + "name": "Run actions/upload-artifact@v4", + "number": 9, + "startedAt": "2026-09-13T11:33:05Z", + "status": "completed" + }, + { + "completedAt": "2026-09-13T11:33:06Z", + "conclusion": "success", + "name": "Post Run actions/setup-node@v7", + "number": 16, + "startedAt": "2026-09-13T11:33:06Z", + "status": "completed" + }, + { + "completedAt": "2026-09-13T11:33:06Z", + "conclusion": "success", + "name": "Post Run actions/checkout@v4", + "number": 17, + "startedAt": "2026-09-13T11:33:06Z", + "status": "completed" + }, + { + "completedAt": "2026-09-13T11:33:07Z", + "conclusion": "success", + "name": "Post Run actions/checkout@v4", + "number": 18, + "startedAt": "2026-09-13T11:33:06Z", + "status": "completed" + }, + { + "completedAt": "2026-09-13T11:33:07Z", + "conclusion": "success", + "name": "Complete job", + "number": 19, + "startedAt": "2026-09-13T11:33:07Z", + "status": "completed" + } + ], + "url": "https://github.com/Yangjunjie-Lin/Scanly/actions/runs/34754673547/job/103716927540" + } + ], + "status": "completed", + "url": "https://github.com/Yangjunjie-Lin/Scanly/actions/runs/34754673547", + "workflowName": "v2.1 Artifact Qualification" +} diff --git a/release/stable/v2.1.0/publication-recovery/reproducibility.json b/release/stable/v2.1.0/publication-recovery/reproducibility.json new file mode 100644 index 0000000..dc5da79 --- /dev/null +++ b/release/stable/v2.1.0/publication-recovery/reproducibility.json @@ -0,0 +1,146 @@ +{ + "schemaVersion": "scanly-v2.1-npm-reproducibility-1", + "version": "2.1.0", + "sourceCommit": "6b017b53a4404f4feab776ac111b0ea9dacf2734", + "sourceTree": "c72430a2ab0a2d47e7cd095325088f1e053a5c41", + "status": "PASS", + "independentBuildJobs": [ + 103716927432, + 103716927540 + ], + "runId": 34754673547, + "cleanBuildRunA": "https://github.com/Yangjunjie-Lin/Scanly/actions/runs/34754673547/job/103716927432", + "cleanBuildRunB": "https://github.com/Yangjunjie-Lin/Scanly/actions/runs/34754673547/job/103716927540", + "cleanBuildA": { + "scanly-benchmark-2.1.0.tgz": "468b1cf37bf229029651fa1e6d6ec63414902578ea1f34b1f8632704ee47e9dd", + "scanly-browser-2.1.0.tgz": "c173f88dab2a0402ee549c9e609868c2b50145a8096ecc3c0c668a2823b92727", + "scanly-core-2.1.0.tgz": "7a529c1c940ace1d961bd1df668f668623bcbac1527827579433efffeb10e416", + "scanly-engine-jsqr-2.1.0.tgz": "b530dcb7949290f068fa3dd3805c0ee23b26d4554cc920f058f1c6c6f3afc68b", + "scanly-engine-zxing-cpp-wasm-2.1.0.tgz": "5215d8e09ff67ea07cececae51d34a975ae0396723ab235c627081568b1b796c", + "scanly-engine-zxing-js-2.1.0.tgz": "420c12ac6a7170c004cee7ce25af9e69f56165b1d50e31ebb1acf4eb03b2eecf", + "scanly-node-2.1.0.tgz": "13207d6afba9038cf721bb9462ff096aedaa658ed22596c10f5529eb08fc3573", + "scanly-parsers-2.1.0.tgz": "2d71b9713d1b8d084b8c9bdeb0ffbe079b3df54a16488e50dabe857c374cb868", + "scanly-react-2.1.0.tgz": "e709ec6f963a91f593a55efcda65e5cf524774154496a1011d8474bb7ab9b8ff", + "scanly-scenario-schema-2.1.0.tgz": "b55e951e1fcd5e129200beab60ee057dee23d4694409df75d007c0953a7e90b1", + "scanly-url-safety-2.1.0.tgz": "72bbd5974b2a0b0c2c1ded6098c249084df0fbffe50a937ef96e68902b914a87" + }, + "cleanBuildB": { + "scanly-benchmark-2.1.0.tgz": "468b1cf37bf229029651fa1e6d6ec63414902578ea1f34b1f8632704ee47e9dd", + "scanly-browser-2.1.0.tgz": "c173f88dab2a0402ee549c9e609868c2b50145a8096ecc3c0c668a2823b92727", + "scanly-core-2.1.0.tgz": "7a529c1c940ace1d961bd1df668f668623bcbac1527827579433efffeb10e416", + "scanly-engine-jsqr-2.1.0.tgz": "b530dcb7949290f068fa3dd3805c0ee23b26d4554cc920f058f1c6c6f3afc68b", + "scanly-engine-zxing-cpp-wasm-2.1.0.tgz": "5215d8e09ff67ea07cececae51d34a975ae0396723ab235c627081568b1b796c", + "scanly-engine-zxing-js-2.1.0.tgz": "420c12ac6a7170c004cee7ce25af9e69f56165b1d50e31ebb1acf4eb03b2eecf", + "scanly-node-2.1.0.tgz": "13207d6afba9038cf721bb9462ff096aedaa658ed22596c10f5529eb08fc3573", + "scanly-parsers-2.1.0.tgz": "2d71b9713d1b8d084b8c9bdeb0ffbe079b3df54a16488e50dabe857c374cb868", + "scanly-react-2.1.0.tgz": "e709ec6f963a91f593a55efcda65e5cf524774154496a1011d8474bb7ab9b8ff", + "scanly-scenario-schema-2.1.0.tgz": "b55e951e1fcd5e129200beab60ee057dee23d4694409df75d007c0953a7e90b1", + "scanly-url-safety-2.1.0.tgz": "72bbd5974b2a0b0c2c1ded6098c249084df0fbffe50a937ef96e68902b914a87" + }, + "rawBuildAEqualsBuildB": true, + "detachedProvenanceVerified": [ + { + "package": "@scanly/benchmark", + "file": "release/stable/v2.1.0/publication-recovery/provenance-A/scanly-benchmark-2.1.0.tgz.sigstore.json", + "sha256": "9ca8c601edf25db755ac9773a0e208cfad29eb62e24489a34edd9d17bd466d93", + "artifactSha256": "468b1cf37bf229029651fa1e6d6ec63414902578ea1f34b1f8632704ee47e9dd", + "artifactSha512": "6e262c1f70df8cc03d30f8d096d7cf3fcfbaf392d5e9e7fea4ac3da4d3d098f95c9f064b6a75c738b49e984b4176b1e2b7a0d648e877bc6261962bcbec60d5cf", + "certificateIdentity": "https://github.com/Yangjunjie-Lin/Scanly/.github/workflows/v2.1-artifact-qualification.yml@refs/heads/codex/v2.1-npm-provenance-recovery", + "verified": true + }, + { + "package": "@scanly/browser", + "file": "release/stable/v2.1.0/publication-recovery/provenance-A/scanly-browser-2.1.0.tgz.sigstore.json", + "sha256": "bfe37937da67ce98d45bccc4aca2a7200040cf13860ff9d5b139d220c3be138a", + "artifactSha256": "c173f88dab2a0402ee549c9e609868c2b50145a8096ecc3c0c668a2823b92727", + "artifactSha512": "07ffa207aa2a82609b0e808ae9221c3c773590406b3fe11dd45e4cf9840fc162170e42efda8d82ef72b39b9f33308e84db818a0239e563b37c66d008c768cf3e", + "certificateIdentity": "https://github.com/Yangjunjie-Lin/Scanly/.github/workflows/v2.1-artifact-qualification.yml@refs/heads/codex/v2.1-npm-provenance-recovery", + "verified": true + }, + { + "package": "@scanly/core", + "file": "release/stable/v2.1.0/publication-recovery/provenance-A/scanly-core-2.1.0.tgz.sigstore.json", + "sha256": "2ed45b23d5f2fb1248f007c53a02af0498cfe065df353d583e439f0c4558e5f2", + "artifactSha256": "7a529c1c940ace1d961bd1df668f668623bcbac1527827579433efffeb10e416", + "artifactSha512": "c6a81231287f8c9b7a7e30481f65d497496771b003d7d3114a0bc7cdec03baac801baa6c095978b91d77f48ec489a03205508289cdfcdee9b72a5e8ead10e2bd", + "certificateIdentity": "https://github.com/Yangjunjie-Lin/Scanly/.github/workflows/v2.1-artifact-qualification.yml@refs/heads/codex/v2.1-npm-provenance-recovery", + "verified": true + }, + { + "package": "@scanly/engine-jsqr", + "file": "release/stable/v2.1.0/publication-recovery/provenance-A/scanly-engine-jsqr-2.1.0.tgz.sigstore.json", + "sha256": "2dc6df190d4e04822c61c8eed2412a814154772671de71c5c530863ea71528cd", + "artifactSha256": "b530dcb7949290f068fa3dd3805c0ee23b26d4554cc920f058f1c6c6f3afc68b", + "artifactSha512": "4550a7b56196e3f686de41cf278f9f28c9a9d57ccb6e6277a0ff707ecd8422c24d0ba53f63851d181b4b08b62026fc5d2b3191c522bc9c38d7745a0d58854d35", + "certificateIdentity": "https://github.com/Yangjunjie-Lin/Scanly/.github/workflows/v2.1-artifact-qualification.yml@refs/heads/codex/v2.1-npm-provenance-recovery", + "verified": true + }, + { + "package": "@scanly/engine-zxing-cpp-wasm", + "file": "release/stable/v2.1.0/publication-recovery/provenance-A/scanly-engine-zxing-cpp-wasm-2.1.0.tgz.sigstore.json", + "sha256": "e97c51ce77400e173ab5623bba5864cf9a6ea6e4a706b6c8808fdc113090158d", + "artifactSha256": "5215d8e09ff67ea07cececae51d34a975ae0396723ab235c627081568b1b796c", + "artifactSha512": "46734c49cc0776b26edc1fa6261f78a028a6dd0ec97a7433cd22101648836faeba04c547e90510372fa7da4133d0303f85118cec2b17100581a160cb047bbc39", + "certificateIdentity": "https://github.com/Yangjunjie-Lin/Scanly/.github/workflows/v2.1-artifact-qualification.yml@refs/heads/codex/v2.1-npm-provenance-recovery", + "verified": true + }, + { + "package": "@scanly/engine-zxing-js", + "file": "release/stable/v2.1.0/publication-recovery/provenance-A/scanly-engine-zxing-js-2.1.0.tgz.sigstore.json", + "sha256": "ddea3326749fde9c41cb5f64f8764ab1d2b5ddc39bb80b05c96eebcfdee8f2f7", + "artifactSha256": "420c12ac6a7170c004cee7ce25af9e69f56165b1d50e31ebb1acf4eb03b2eecf", + "artifactSha512": "49a7c63ddf6317b9662f1be45d92b8ea9289fbb51d4d364a5c1e3e899e82101afd268d26a8af25cb8a739bd4d213f23ea499d4cb5b00e95fff6dc7cfcf0d0fda", + "certificateIdentity": "https://github.com/Yangjunjie-Lin/Scanly/.github/workflows/v2.1-artifact-qualification.yml@refs/heads/codex/v2.1-npm-provenance-recovery", + "verified": true + }, + { + "package": "@scanly/node", + "file": "release/stable/v2.1.0/publication-recovery/provenance-A/scanly-node-2.1.0.tgz.sigstore.json", + "sha256": "940ca61b1285dbf2462d3a3a05a8774298c0f7b965d0790b7660192daa9e5a15", + "artifactSha256": "13207d6afba9038cf721bb9462ff096aedaa658ed22596c10f5529eb08fc3573", + "artifactSha512": "88f404c159d400a4a03eff00294ad2076dc17dbc84b253c33fc8b742b975becc35d602e9fa529ff0ca91dc635148a8078d5564880973a63c49a2a7c6d1dc337e", + "certificateIdentity": "https://github.com/Yangjunjie-Lin/Scanly/.github/workflows/v2.1-artifact-qualification.yml@refs/heads/codex/v2.1-npm-provenance-recovery", + "verified": true + }, + { + "package": "@scanly/parsers", + "file": "release/stable/v2.1.0/publication-recovery/provenance-A/scanly-parsers-2.1.0.tgz.sigstore.json", + "sha256": "dfd7825c577634ec9846b2c4d056b19948a82292c28c35e6ce914238b4cd5076", + "artifactSha256": "2d71b9713d1b8d084b8c9bdeb0ffbe079b3df54a16488e50dabe857c374cb868", + "artifactSha512": "1aa6833407e9d26ad02b160f253796e73d9517c5c9aa5d6d64795fccc37591f4d1997f443ff5ba34f0c05fea35c9bb217b23916f4b2418ef04f099a88b594755", + "certificateIdentity": "https://github.com/Yangjunjie-Lin/Scanly/.github/workflows/v2.1-artifact-qualification.yml@refs/heads/codex/v2.1-npm-provenance-recovery", + "verified": true + }, + { + "package": "@scanly/react", + "file": "release/stable/v2.1.0/publication-recovery/provenance-A/scanly-react-2.1.0.tgz.sigstore.json", + "sha256": "7c58ddb012647412971c5d3acbb904cd8961d3bf440b75db5aded7c8321a14a8", + "artifactSha256": "e709ec6f963a91f593a55efcda65e5cf524774154496a1011d8474bb7ab9b8ff", + "artifactSha512": "8c2b8ee908aa097ce7c132a4fbd3671e1264665ed4cd34a7de3cc52188e800acbd2dd8d255cdb10f786b68638310d8301a11fb6c8c71b7e080bda88741f0a497", + "certificateIdentity": "https://github.com/Yangjunjie-Lin/Scanly/.github/workflows/v2.1-artifact-qualification.yml@refs/heads/codex/v2.1-npm-provenance-recovery", + "verified": true + }, + { + "package": "@scanly/scenario-schema", + "file": "release/stable/v2.1.0/publication-recovery/provenance-A/scanly-scenario-schema-2.1.0.tgz.sigstore.json", + "sha256": "f77c63558cca55d8b8e7aad1bfc4f322085230ab73136915c418e864839b4c90", + "artifactSha256": "b55e951e1fcd5e129200beab60ee057dee23d4694409df75d007c0953a7e90b1", + "artifactSha512": "973fc3a387a978f8f52e63a82f574cf829c2bdd12bb5b0ad7f5766206e8610269d0e69aae90eb45f560f794a9223f9422010d54bc8a40e82ae32c027468eddbe", + "certificateIdentity": "https://github.com/Yangjunjie-Lin/Scanly/.github/workflows/v2.1-artifact-qualification.yml@refs/heads/codex/v2.1-npm-provenance-recovery", + "verified": true + }, + { + "package": "@scanly/url-safety", + "file": "release/stable/v2.1.0/publication-recovery/provenance-A/scanly-url-safety-2.1.0.tgz.sigstore.json", + "sha256": "30717ca382475727d43bd9fe08a9d3766901997bdf1c5393e98ec5e55c9f455a", + "artifactSha256": "72bbd5974b2a0b0c2c1ded6098c249084df0fbffe50a937ef96e68902b914a87", + "artifactSha512": "269e2f2ed7dbb71926b1eaf33e06df8ed17cf1a0aa16b741252fa2c59a3929588d7549e5aa6655d142bff1b19803db8ad5bf3949562df4d65eba53a84d531c5e", + "certificateIdentity": "https://github.com/Yangjunjie-Lin/Scanly/.github/workflows/v2.1-artifact-qualification.yml@refs/heads/codex/v2.1-npm-provenance-recovery", + "verified": true + } + ], + "packageCount": 11, + "published": false, + "npmRegistrySourceIdentityCompatible": true, + "frozenReleaseArtifactsEqual": true +} diff --git a/release/stable/v2.1.0/v2.1.0-provenance-recovery.json b/release/stable/v2.1.0/v2.1.0-provenance-recovery.json new file mode 100644 index 0000000..63ad465 --- /dev/null +++ b/release/stable/v2.1.0/v2.1.0-provenance-recovery.json @@ -0,0 +1,143 @@ +{ + "schemaVersion": "scanly-v2.1-provenance-recovery-1", + "version": "2.1.0", + "package": "@scanly/url-safety", + "reason": "npm Registry rejected the original cryptographically valid bundle with E422: dependency zero did not match certificate SourceRepositoryURI/SourceRepositoryDigest. Two fresh independent builds retain the real product source separately and bind dependency zero to the actual GitHub certificate source. No frozen tag, manifest, tarball, or original proof was changed.", + "qualificationManifest": { + "path": "release/stable/v2.1.0/v2.1.0-manifest.json", + "sha256": "89faaff164bafde1033264380f5d19b7c1c168f97d4fc4120a4f4c695686e142" + }, + "originalProvenance": { + "path": "release/stable/v2.1.0/artifacts/provenance/scanly-url-safety-2.1.0.tgz.sigstore.json", + "sha256": "d1dbb1347fad221ca90770d8bfbd681f6813a7b70b6237e79f983d1ffc47eb87", + "registryAccepted": false + }, + "artifact": { + "path": "release/stable/v2.1.0/artifacts/npm/scanly-url-safety-2.1.0.tgz", + "sha256": "72bbd5974b2a0b0c2c1ded6098c249084df0fbffe50a937ef96e68902b914a87", + "sha512": "269e2f2ed7dbb71926b1eaf33e06df8ed17cf1a0aa16b741252fa2c59a3929588d7549e5aa6655d142bff1b19803db8ad5bf3949562df4d65eba53a84d531c5e" + }, + "replacementProvenance": { + "path": "release/stable/v2.1.0/publication-recovery/provenance-A/scanly-url-safety-2.1.0.tgz.sigstore.json", + "sha256": "30717ca382475727d43bd9fe08a9d3766901997bdf1c5393e98ec5e55c9f455a" + }, + "sourceCommit": "6b017b53a4404f4feab776ac111b0ea9dacf2734", + "sourceTree": "c72430a2ab0a2d47e7cd095325088f1e053a5c41", + "workflowDefinitionCommit": "e22d100163565164e2149f99ab54d11a6111932b", + "workflowRef": "Yangjunjie-Lin/Scanly/.github/workflows/v2.1-artifact-qualification.yml@refs/heads/codex/v2.1-npm-provenance-recovery", + "runId": 34754673547, + "runAttempt": 1, + "independentBuildJobs": [ + 103716927432, + 103716927540 + ], + "evidence": [ + { + "path": "release/stable/v2.1.0/publication-recovery/qualification-run.json", + "sha256": "b506fe5d9075c52508775ef24cabf04e740048f0e8fb3980f6f1e00def3de041" + }, + { + "path": "release/stable/v2.1.0/publication-recovery/build-A.json", + "sha256": "a2b10f8481d64665b089ce934eeef8fb2189713fc3c3ad32fd5725c3b63f3444" + }, + { + "path": "release/stable/v2.1.0/publication-recovery/provenance-A/scanly-benchmark-2.1.0.tgz.sigstore.json", + "sha256": "9ca8c601edf25db755ac9773a0e208cfad29eb62e24489a34edd9d17bd466d93" + }, + { + "path": "release/stable/v2.1.0/publication-recovery/provenance-A/scanly-browser-2.1.0.tgz.sigstore.json", + "sha256": "bfe37937da67ce98d45bccc4aca2a7200040cf13860ff9d5b139d220c3be138a" + }, + { + "path": "release/stable/v2.1.0/publication-recovery/provenance-A/scanly-core-2.1.0.tgz.sigstore.json", + "sha256": "2ed45b23d5f2fb1248f007c53a02af0498cfe065df353d583e439f0c4558e5f2" + }, + { + "path": "release/stable/v2.1.0/publication-recovery/provenance-A/scanly-engine-jsqr-2.1.0.tgz.sigstore.json", + "sha256": "2dc6df190d4e04822c61c8eed2412a814154772671de71c5c530863ea71528cd" + }, + { + "path": "release/stable/v2.1.0/publication-recovery/provenance-A/scanly-engine-zxing-cpp-wasm-2.1.0.tgz.sigstore.json", + "sha256": "e97c51ce77400e173ab5623bba5864cf9a6ea6e4a706b6c8808fdc113090158d" + }, + { + "path": "release/stable/v2.1.0/publication-recovery/provenance-A/scanly-engine-zxing-js-2.1.0.tgz.sigstore.json", + "sha256": "ddea3326749fde9c41cb5f64f8764ab1d2b5ddc39bb80b05c96eebcfdee8f2f7" + }, + { + "path": "release/stable/v2.1.0/publication-recovery/provenance-A/scanly-node-2.1.0.tgz.sigstore.json", + "sha256": "940ca61b1285dbf2462d3a3a05a8774298c0f7b965d0790b7660192daa9e5a15" + }, + { + "path": "release/stable/v2.1.0/publication-recovery/provenance-A/scanly-parsers-2.1.0.tgz.sigstore.json", + "sha256": "dfd7825c577634ec9846b2c4d056b19948a82292c28c35e6ce914238b4cd5076" + }, + { + "path": "release/stable/v2.1.0/publication-recovery/provenance-A/scanly-react-2.1.0.tgz.sigstore.json", + "sha256": "7c58ddb012647412971c5d3acbb904cd8961d3bf440b75db5aded7c8321a14a8" + }, + { + "path": "release/stable/v2.1.0/publication-recovery/provenance-A/scanly-scenario-schema-2.1.0.tgz.sigstore.json", + "sha256": "f77c63558cca55d8b8e7aad1bfc4f322085230ab73136915c418e864839b4c90" + }, + { + "path": "release/stable/v2.1.0/publication-recovery/provenance-A/scanly-url-safety-2.1.0.tgz.sigstore.json", + "sha256": "30717ca382475727d43bd9fe08a9d3766901997bdf1c5393e98ec5e55c9f455a" + }, + { + "path": "release/stable/v2.1.0/publication-recovery/build-B.json", + "sha256": "46edbd9b522d5743c26dda4d33de04fae1f53ba736b597731918f9280bc1815a" + }, + { + "path": "release/stable/v2.1.0/publication-recovery/provenance-B/scanly-benchmark-2.1.0.tgz.sigstore.json", + "sha256": "3f7cdd525bd73d8ae0c189053ffcc232015862d657f0ac82d2ece6f238ba7b9a" + }, + { + "path": "release/stable/v2.1.0/publication-recovery/provenance-B/scanly-browser-2.1.0.tgz.sigstore.json", + "sha256": "fd1d643c44e53c18d448e639da02eca5684b980f4dec9d309316850a897ec1ca" + }, + { + "path": "release/stable/v2.1.0/publication-recovery/provenance-B/scanly-core-2.1.0.tgz.sigstore.json", + "sha256": "686e2b5d3fce4ef890e0abf982a85ad2b860e5074c9347f427cd3b70fbd06dab" + }, + { + "path": "release/stable/v2.1.0/publication-recovery/provenance-B/scanly-engine-jsqr-2.1.0.tgz.sigstore.json", + "sha256": "1d7bb45f10a318e2911e75802412e24b1d1e1eec477a491f35b2467acfe06b21" + }, + { + "path": "release/stable/v2.1.0/publication-recovery/provenance-B/scanly-engine-zxing-cpp-wasm-2.1.0.tgz.sigstore.json", + "sha256": "d3e591883cb3a7c92e22b08c851009a17adfe5e5645e7045aea4da7e81f5a5c5" + }, + { + "path": "release/stable/v2.1.0/publication-recovery/provenance-B/scanly-engine-zxing-js-2.1.0.tgz.sigstore.json", + "sha256": "ace7b5a4fee1553aec49599231dd84b1622744356414b6df09f4d40325a9304e" + }, + { + "path": "release/stable/v2.1.0/publication-recovery/provenance-B/scanly-node-2.1.0.tgz.sigstore.json", + "sha256": "b71e17f7b53fc943b23cd92df8dd9220b6d33a2d5d8bd331ba4b892d86cbec53" + }, + { + "path": "release/stable/v2.1.0/publication-recovery/provenance-B/scanly-parsers-2.1.0.tgz.sigstore.json", + "sha256": "839823dca1ee698002dbfa39de7507ce8e8c6d53089801cae3a04c06722f9c29" + }, + { + "path": "release/stable/v2.1.0/publication-recovery/provenance-B/scanly-react-2.1.0.tgz.sigstore.json", + "sha256": "e88519b2bef24d11b953a4c7e9c6c6670f7b9038a63abc62e17213cce1da9e2c" + }, + { + "path": "release/stable/v2.1.0/publication-recovery/provenance-B/scanly-scenario-schema-2.1.0.tgz.sigstore.json", + "sha256": "50be2740712a76e80ee0059dc57b0a3f73a90b8072cc20b6e99a8c8f0abc0e0d" + }, + { + "path": "release/stable/v2.1.0/publication-recovery/provenance-B/scanly-url-safety-2.1.0.tgz.sigstore.json", + "sha256": "bb9366faafef9d3541c0129facc15e66a3d56ca8ee20c676add6275872a1921b" + }, + { + "path": "release/stable/v2.1.0/publication-recovery/reproducibility.json", + "sha256": "1751faa0df798a46ab6330ddb9a8ac1d87d3027262fd15e2f81896d22d8e077a" + } + ], + "npmCredentialsUsedByCI": false, + "published": false, + "createdAt": "2026-09-13T11:35:18.847Z" +} diff --git a/scripts/publish-v2.1-bootstrap.mjs b/scripts/publish-v2.1-bootstrap.mjs index 8f6535b..5ce7933 100644 --- a/scripts/publish-v2.1-bootstrap.mjs +++ b/scripts/publish-v2.1-bootstrap.mjs @@ -4,6 +4,7 @@ import fs from "node:fs"; import path from "node:path"; import { execFileSync } from "node:child_process"; import { createRequire } from "node:module"; +import { validateNpmBuildIdentity } from "./npm-provenance-identity.mjs"; const root = process.cwd(); const tag = "v2.1.0"; @@ -24,7 +25,7 @@ const credentials = JSON.parse(fs.readFileSync(`${directory}/publication-credent const bootstrap = credentials.channels.npmRegistry.evidence.bootstrap; assert.equal(bootstrap.package, "@scanly/url-safety"); assert.equal(bootstrap.version, "2.1.0"); const artifactFile = path.resolve(root, bootstrap.artifactPath); -const provenanceFile = path.resolve(root, bootstrap.provenancePath); +let provenanceFile = path.resolve(root, bootstrap.provenancePath); const bytes = fs.readFileSync(artifactFile); assert.equal(crypto.createHash("sha256").update(bytes).digest("hex"), bootstrap.artifactSha256); assert.equal(crypto.createHash("sha512").update(bytes).digest("hex"), bootstrap.artifactSha512); @@ -32,6 +33,48 @@ assert.equal(crypto.createHash("sha256").update(fs.readFileSync(provenanceFile)) const requireNpm = createRequire(npmCli); const verifier = requireNpm(path.join(path.dirname(requireNpm.resolve("libnpmpublish")), "provenance.js")); await verifier.verifyProvenance({ name: "pkg:npm/%40scanly/url-safety@2.1.0", digest: { sha512: bootstrap.artifactSha512 } }, provenanceFile); +// A Registry compatibility repair is additive. The tag-bound original bundle, +// tarball, manifest, and credential policy above remain independently checked. +const recoveryArg = process.argv.slice(2); +assert.ok(recoveryArg.length === 0 || (recoveryArg.length === 1 && recoveryArg[0] === "--qualified-provenance-recovery"), "Unknown bootstrap arguments"); +if (recoveryArg.length) { + const recovery = JSON.parse(fs.readFileSync(`${directory}/v2.1.0-provenance-recovery.json`, "utf8")); + const hashFile = (p) => crypto.createHash("sha256").update(fs.readFileSync(p)).digest("hex"); + assert.equal(recovery.schemaVersion, "scanly-v2.1-provenance-recovery-1"); + assert.equal(recovery.version, "2.1.0"); assert.equal(recovery.package, bootstrap.package); + assert.equal(recovery.sourceCommit, bootstrap.sourceCommit); + assert.equal(recovery.sourceTree, git("show", "-s", "--format=%T", bootstrap.sourceCommit)); + assert.deepEqual(recovery.artifact, { path: bootstrap.artifactPath, sha256: bootstrap.artifactSha256, sha512: bootstrap.artifactSha512 }); + assert.deepEqual(recovery.originalProvenance, { path: bootstrap.provenancePath, sha256: bootstrap.provenanceSha256, registryAccepted: false }); + assert.deepEqual(recovery.qualificationManifest, { path: manifestFile, sha256: hashFile(manifestFile) }); + assert.equal(recovery.npmCredentialsUsedByCI, false); + assert.equal(recovery.replacementProvenance.path, `${directory}/publication-recovery/provenance-A/scanly-url-safety-2.1.0.tgz.sigstore.json`); + provenanceFile = path.resolve(root, recovery.replacementProvenance.path); + assert.equal(hashFile(provenanceFile), recovery.replacementProvenance.sha256); + for (const evidence of recovery.evidence) { + assert.ok(evidence.path.startsWith(`${directory}/publication-recovery/`) && !evidence.path.includes("..") && !evidence.path.includes("\\")); + assert.equal(hashFile(evidence.path), evidence.sha256); + } + const run = JSON.parse(execFileSync("gh", ["run", "view", String(recovery.runId), "--repo", "Yangjunjie-Lin/Scanly", "--json", "headSha,status,conclusion,jobs,workflowName"], { encoding: "utf8" })); + assert.equal(run.status, "completed"); assert.equal(run.conclusion, "success"); + assert.equal(run.workflowName, "v2.1 Artifact Qualification"); + assert.equal(run.headSha, recovery.workflowDefinitionCommit); + assert.equal(new Set(recovery.independentBuildJobs).size, 2); + const sigstore = requireNpm("sigstore"); + for (const [index, label] of ["A", "B"].entries()) { + assert.ok(run.jobs.some((job) => job.name === `Clean npm build ${label}` && job.databaseId === recovery.independentBuildJobs[index] && job.conclusion === "success")); + const bundleFile = `${directory}/publication-recovery/provenance-${label}/scanly-url-safety-2.1.0.tgz.sigstore.json`; + const bundle = await verifier.verifyProvenance({ name: "pkg:npm/%40scanly/url-safety@2.1.0", digest: { sha512: bootstrap.artifactSha512 } }, bundleFile); + assert.ok(recovery.workflowRef.startsWith("Yangjunjie-Lin/Scanly/.github/workflows/v2.1-artifact-qualification.yml@")); + await sigstore.verify(bundle, { certificateIssuer: "https://token.actions.githubusercontent.com", certificateIdentityURI: `https://github.com/${recovery.workflowRef}` }); + const statement = JSON.parse(Buffer.from(bundle.dsseEnvelope.payload, "base64").toString("utf8")); + validateNpmBuildIdentity(statement, { sourceCommit: recovery.sourceCommit, workflowCommit: run.headSha, workflowRef: recovery.workflowRef.split("@")[1] }); + assert.equal(statement.predicate.runDetails.metadata.invocationId, `https://github.com/Yangjunjie-Lin/Scanly/actions/runs/${recovery.runId}/attempts/${recovery.runAttempt}`); + } + console.log("Verified additive provenance recovery against the frozen artifact, live successful build run, and two independent signed bundles."); +} else { + assert.fail("Original bundle is Registry-incompatible (E422). Generate and verify additive recovery evidence, then use --qualified-provenance-recovery. Do not retry authentication with the rejected bundle."); +} assert.equal(runNpm("whoami"), "yangjunjielin"); const artifacts = JSON.parse(fs.readFileSync(`${directory}/artifact-manifest.json`, "utf8")).artifacts; const parser = artifacts.find((artifact) => artifact.platform === "npm" && artifact.path.endsWith("scanly-parsers-2.1.0.tgz")); diff --git a/scripts/record-v2.1-provenance-recovery.mjs b/scripts/record-v2.1-provenance-recovery.mjs new file mode 100644 index 0000000..58fad7b --- /dev/null +++ b/scripts/record-v2.1-provenance-recovery.mjs @@ -0,0 +1,58 @@ +import assert from "node:assert/strict"; +import fs from "node:fs"; +import path from "node:path"; +import crypto from "node:crypto"; +import { execFileSync } from "node:child_process"; + +const [buildA, buildB, runId] = process.argv.slice(2); +assert.ok(buildA && buildB && /^\d+$/.test(runId ?? ""), "Use "); +assert.ok(process.env.NPM_CLI_PATH); +const root = "release/stable/v2.1.0", directory = `${root}/publication-recovery`; +const output = `${root}/v2.1.0-provenance-recovery.json`; +assert.ok(!fs.existsSync(directory) && !fs.existsSync(output), "Never overwrite recovery evidence"); +const read = (p) => JSON.parse(fs.readFileSync(p, "utf8")); +const hash = (p) => crypto.createHash("sha256").update(fs.readFileSync(p)).digest("hex"); +const write = (p, value) => fs.writeFileSync(p, JSON.stringify(value, null, 2) + "\n"); +const run = JSON.parse(execFileSync("gh", ["run", "view", runId, "--repo", "Yangjunjie-Lin/Scanly", "--json", "databaseId,status,conclusion,headSha,jobs,url,event,workflowName"], { encoding: "utf8" })); +assert.equal(run.status, "completed"); assert.equal(run.conclusion, "success"); +assert.equal(run.workflowName, "v2.1 Artifact Qualification"); +const manifestPath = `${root}/v2.1.0-manifest.json`; +assert.ok(execFileSync("git", ["show", `v2.1.0:${manifestPath}`]).equals(fs.readFileSync(manifestPath))); +const manifest = read(manifestPath), bootstrap = read(`${root}/publication-credentials.json`).channels.npmRegistry.evidence.bootstrap; +for (const build of [buildA, buildB]) assert.equal(read(path.join(build, "build.json")).sourceCommit, manifest.identity.productSourceCommit); +const scratch = fs.mkdtempSync(path.resolve("release-dist", "provenance-recovery-")); +const runPath = path.join(scratch, "run.json"), reportPath = path.join(scratch, "reproducibility.json"); +write(runPath, run); +execFileSync(process.execPath, ["scripts/verify-v2.1-artifact-builds.mjs", `--build-a=${buildA}`, `--build-b=${buildB}`, `--run-evidence=${runPath}`, `--npm-cli=${process.env.NPM_CLI_PATH}`, `--output=${reportPath}`, "--npm-compatible=true", `--frozen-artifacts=${root}/artifact-manifest.json`], { stdio: "inherit" }); +fs.mkdirSync(directory); +const evidence = []; +const preserve = (from, name) => { + const to = `${directory}/${name}`; fs.mkdirSync(path.dirname(to), { recursive: true }); + fs.copyFileSync(from, to); evidence.push({ path: to, sha256: hash(to) }); return to; +}; +preserve(runPath, "qualification-run.json"); +for (const [index, build] of [buildA, buildB].entries()) { + const label = index === 0 ? "A" : "B", report = read(path.join(build, "build.json")); + preserve(path.join(build, "build.json"), `build-${label}.json`); + for (const artifact of report.artifacts) preserve(path.join(build, "provenance", artifact.provenanceFile), `provenance-${label}/${artifact.provenanceFile}`); +} +const reproducibility = read(reportPath); +for (const proof of reproducibility.detachedProvenanceVerified) proof.file = `${directory}/provenance-A/${path.basename(proof.file)}`; +write(`${directory}/reproducibility.json`, { ...reproducibility, npmRegistrySourceIdentityCompatible: true, frozenReleaseArtifactsEqual: true }); +evidence.push({ path: `${directory}/reproducibility.json`, sha256: hash(`${directory}/reproducibility.json`) }); +const provenancePath = `${directory}/provenance-A/scanly-url-safety-2.1.0.tgz.sigstore.json`; +const reportA = read(path.join(buildA, "build.json")); +const record = { + schemaVersion: "scanly-v2.1-provenance-recovery-1", version: "2.1.0", package: "@scanly/url-safety", + reason: "npm Registry rejected the original cryptographically valid bundle with E422: dependency zero did not match certificate SourceRepositoryURI/SourceRepositoryDigest. Two fresh independent builds retain the real product source separately and bind dependency zero to the actual GitHub certificate source. No frozen tag, manifest, tarball, or original proof was changed.", + qualificationManifest: { path: manifestPath, sha256: hash(manifestPath) }, + originalProvenance: { path: bootstrap.provenancePath, sha256: bootstrap.provenanceSha256, registryAccepted: false }, + artifact: { path: bootstrap.artifactPath, sha256: bootstrap.artifactSha256, sha512: bootstrap.artifactSha512 }, + replacementProvenance: { path: provenancePath, sha256: hash(provenancePath) }, + sourceCommit: reportA.sourceCommit, sourceTree: reportA.sourceTree, + workflowDefinitionCommit: run.headSha, workflowRef: reportA.workflowRef, runId: Number(runId), runAttempt: reportA.runAttempt, + independentBuildJobs: reproducibility.independentBuildJobs, + evidence, npmCredentialsUsedByCI: false, published: false, createdAt: new Date().toISOString(), +}; +write(output, record); +console.log(`V2_1_PROVENANCE_RECOVERY_QUALIFIED: ${output}`); From 71a338b816c6e58b276f3d27de4da73724b4afa7 Mon Sep 17 00:00:00 2001 From: Yangjunjie Lin Date: Sun, 13 Sep 2026 13:11:48 +0100 Subject: [PATCH 3/6] release: record verified v2.1.0 publication and finalize current guides --- CHANGELOG.md | 1 + CONTRIBUTING.md | 2 +- README.md | 4 +- SECURITY.md | 7 +- docs/README.md | 8 +- docs/maintenance.md | 8 +- docs/migration/v1-to-v2.md | 10 +- docs/native/android-getting-started.md | 12 +- docs/native/architecture.md | 4 +- docs/native/compatibility.md | 8 +- docs/native/cross-platform-wrapper-plan.md | 4 +- docs/native/ios-getting-started.md | 10 +- docs/platform-compatibility.md | 2 +- docs/releases/v2.1.0.md | 10 +- docs/sdk/api-stability.md | 8 +- docs/sdk/public-api.md | 8 +- docs/sdk/usage.md | 4 +- docs/sdk/worker-deployment.md | 2 +- .../v2.1.0/v2.1.0-publication-record.json | 464 ++++++++++++++++++ 19 files changed, 529 insertions(+), 47 deletions(-) create mode 100644 release/stable/v2.1.0/v2.1.0-publication-record.json diff --git a/CHANGELOG.md b/CHANGELOG.md index 355bf0c..ca74d94 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ All notable changes follow semantic versioning. - Added explicit privacy modes and a default-disabled demo, with a same-origin rate/size/time-limited backend. - Existing barcode decoding remains local and independent of network analysis. Published 2.0.0 and 2.0.1 artifacts and historical evidence are unchanged. - Added source-bound independent npm and Native artifact rebuilds, detached CI provenance for the new package's 2FA-protected first publication, and immutable versioned qualification records. Actual publication is verified separately from qualification. +- Completed all 11 npm 2.1.0 publications with exact downloaded-byte and cryptographic provenance verification. Preserved the initial Registry provenance rejection and its independently rebuilt, additive correction without changing the signed tag or frozen artifacts; appended the actual publication record. ## 2.0.1 — Scanner lifecycle and runtime hardening diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 60845af..db5ea43 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,6 +1,6 @@ # Contributing -Thank you for helping maintain Scanly's focused, local-first barcode scanning SDK scope. The public v2.0.1 format set is QR Code, Data Matrix, PDF417, Code 128, EAN-13, EAN-8, UPC-A, and UPC-E. +Thank you for helping maintain Scanly's focused, local-first barcode scanning SDK scope. The public v2.1.0 format set is QR Code, Data Matrix, PDF417, Code 128, EAN-13, EAN-8, UPC-A, and UPC-E. ## Setup diff --git a/README.md b/README.md index ef3817e..3a94257 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,7 @@ Privacy-first, local-only barcode scanning SDK for Web, Node.js, React, iOS, and ## Install -The 2.1.0 release line is software-qualified. Registry publication is finalized separately through the signed release workflow; see the [release notes](docs/releases/v2.1.0.md) and versioned release records below. +All 11 public SDK packages are published at 2.1.0 with verified provenance and exact frozen artifact hashes. See the [release notes](docs/releases/v2.1.0.md) and [immutable publication record](release/stable/v2.1.0/v2.1.0-publication-record.json). Choose the package for your runtime. Browser, Node, and React packages already include their required Scanly workspace dependencies. @@ -181,6 +181,8 @@ Detailed Alpha, Beta, and RC development evidence is preserved in [development h - [v2.1.0 release notes](docs/releases/v2.1.0.md) - [v2.1.0 qualification manifest](release/stable/v2.1.0/v2.1.0-manifest.json) +- [v2.1.0 publication record](release/stable/v2.1.0/v2.1.0-publication-record.json) +- [v2.1.0 additive provenance correction](release/stable/v2.1.0/v2.1.0-provenance-recovery.json) - [v2.1.0 checksums](release/stable/v2.1.0/checksums.sha256) - [v2.1.0 SBOM](release/stable/v2.1.0/sbom.cdx.json) - [v2.0.1 release notes](docs/releases/v2.0.1.md) diff --git a/SECURITY.md b/SECURITY.md index 770da26..58dcffa 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,15 +2,16 @@ ## Supported versions -v2.0.1 is the current Stable release. +v2.1.0 is the current Stable release. | Version | Security support | | --- | --- | +| 2.1.x | Supported; current Stable line | | 2.0.x | Supported | | 1.x | Best-effort security fixes only | | Alpha, Beta, and RC builds | Unsupported historical development builds | -Security fixes normally target the latest supported patch in the 2.0 line. Support does not expand the public API or physical-device qualification claims of a released version. +Security fixes normally target the latest supported patch in the 2.1 line, with applicable fixes considered for supported 2.0.x releases. Support does not expand the public API or physical-device qualification claims of a released version. ## Reporting a vulnerability @@ -34,4 +35,6 @@ Dependency audit results are recorded rather than hidden. Breaking forced upgrad The shipped SDK has no analytics, remote tracking, image upload, remote logging, or diagnostic endpoint. Image pixels and decoded content must not be logged by default. Any future diagnostics must be opt-in and redact both classes of data. +The separate `@scanly/url-safety` module is disabled by default. Network analysis may share only an already-decoded HTTP(S) URL after explicit opt-in; scanner images and frames remain local. Remote inspection is server-only and SSRF-controlled. Provider secrets stay on the server, sensitive query values are redacted from diagnostics and LLM evidence, and LLM output cannot override authoritative threat intelligence. See [URL Safety security and privacy boundaries](docs/url-safety.md). + See the [threat model](docs/security/threat-model.md) and [secure integration guide](docs/security/secure-integration.md). diff --git a/docs/README.md b/docs/README.md index ad6ff4f..00127cf 100644 --- a/docs/README.md +++ b/docs/README.md @@ -10,6 +10,7 @@ ## API and capabilities - [Public API](sdk/public-api.md) +- [Opt-in Link Intelligence / URL Safety](url-safety.md) - [API stability](sdk/api-stability.md) - [Error catalog](sdk/error-catalog.md) - [Cross-platform contract](sdk/cross-platform-contract.md) @@ -36,10 +37,15 @@ ## Migration, benchmarking, and release integrity -- [Migrate from v1 to v2.0.1](migration/v1-to-v2.md) +- [Migrate from v1 to v2.1.0](migration/v1-to-v2.md) - [Post-release Physical Device Validation](physical-device-validation.md) - [Benchmark methodology](benchmarking/methodology.md) - [Benchmark provenance](benchmarking/provenance.md) +- [v2.1.0 release notes](releases/v2.1.0.md) +- [v2.1.0 qualification manifest](../release/stable/v2.1.0/v2.1.0-manifest.json) +- [v2.1.0 publication record](../release/stable/v2.1.0/v2.1.0-publication-record.json) +- [v2.1.0 checksums](../release/stable/v2.1.0/checksums.sha256) +- [v2.1.0 SBOM](../release/stable/v2.1.0/sbom.cdx.json) - [v2.0.1 release notes](releases/v2.0.1.md) - [v2.0.1 qualification manifest](../release/stable/v2.0.1/v2.0.1-manifest.json) - [v2.0.1 checksums](../release/stable/v2.0.1/checksums.sha256) diff --git a/docs/maintenance.md b/docs/maintenance.md index baa6762..3088bfc 100644 --- a/docs/maintenance.md +++ b/docs/maintenance.md @@ -1,6 +1,6 @@ # Maintenance policy -Scanly v2.0.1 is the current Stable SDK line. Maintenance prioritizes security, correctness, compatibility, performance, physical qualification, bug fixes, patch releases, and carefully scoped minor releases. New work must preserve the local-only privacy boundary and the public eight-format contract. +Scanly v2.1.0 is the current Stable SDK line. Maintenance prioritizes security, correctness, compatibility, performance, physical qualification, bug fixes, patch releases, and carefully scoped minor releases. New work must preserve local barcode decoding, the separate opt-in URL Intelligence boundary, and the public eight-format contract. ## Supported toolchain @@ -18,12 +18,12 @@ Scanly v2.0.1 is the current Stable SDK line. Maintenance prioritizes security, - Release qualification is recorded in versioned evidence committed through `develop`; only `main` and `develop` are retained as long-lived branches. - Immutable tags and evidence preserve released history; never move or rebuild a published tag. -For a normal v2.0.1 bug fix: +For a normal bug fix to the 2.1 line: ```text develop -> fix branch -> PR to develop -> versioned qualification evidence -> PR from develop to main --> signed v2.0.1 tag -> GitHub Release -> npm / Native publication +-> signed next-patch tag -> GitHub Release -> npm / Native publication -> synchronize main back into develop ``` @@ -61,7 +61,7 @@ Dependabot opens small npm and GitHub Actions groups. Merge security patches pro ## Physical qualification -Automated browser, simulator, and emulator coverage is not physical-device qualification. The v2.0.0 physical validation program remains `POST_RELEASE_VALIDATION_PENDING` under Issue #13; v2.0.1 does not claim physical PASS or reinterpret those zero evidence counts. +Automated browser, simulator, and emulator coverage is not physical-device qualification. The v2.0.0 physical validation program remains `POST_RELEASE_VALIDATION_PENDING` under Issue #13; neither v2.0.1 nor v2.1.0 claims physical PASS or reinterprets those zero evidence counts. When that program completes, do not modify v2.0.0 binaries or the qualification/publication records. Add `release/stable/v2.0.0-physical-qualification-record.json` containing the released artifact hashes, real device matrix, 30/60-minute soak evidence, and false-positive gate. The release evidence chain is Qualification → Publication → Physical Qualification. diff --git a/docs/migration/v1-to-v2.md b/docs/migration/v1-to-v2.md index cbed8db..6ee6833 100644 --- a/docs/migration/v1-to-v2.md +++ b/docs/migration/v1-to-v2.md @@ -1,6 +1,6 @@ -# Migrating from Scanly v1 to v2.0.1 +# Migrating from Scanly v1 to v2.1.0 -Scanly v2.0.1 is the current Stable SDK. Migrate by selecting the runtime package instead of importing repository-internal v1 modules. +Scanly v2.1.0 is the current Stable SDK. Migrate by selecting the runtime package instead of importing repository-internal v1 modules. ## Install a public package @@ -40,7 +40,7 @@ Camera composition uses `BrowserCameraSource` and the ScannerSession runtime. Ca ## Formats and scenarios -v2.0.1 supports QR Code, Data Matrix, PDF417, Code 128, EAN-13, EAN-8, UPC-A, and UPC-E. The default remains QR-only for compatibility; opt into additional formats explicitly or use a multi-format built-in scenario. +v2.1.0 supports QR Code, Data Matrix, PDF417, Code 128, EAN-13, EAN-8, UPC-A, and UPC-E. The default remains QR-only for compatibility; opt into additional formats explicitly or use a multi-format built-in scenario. ```ts const router = createNodeCaptureRouter({ @@ -52,7 +52,7 @@ The lower-level `decodePixelBuffer` adapter requires a caller-supplied engine ex ## Native availability -- iOS 13+: `ScanlySDK` source package under `native/ios` at tag `v2.0.1`. -- Android API 24+: `scanly-sdk-2.0.1.aar` from the v2.0.1 GitHub Release for `arm64-v8a` and `x86_64`. +- iOS 13+: `ScanlySDK` source package under `native/ios` at tag `v2.1.0`. +- Android API 24+: `scanly-sdk-2.1.0.aar` from the v2.1.0 GitHub Release for `arm64-v8a` and `x86_64`. See the [iOS](../native/ios-getting-started.md) and [Android](../native/android-getting-started.md) guides. Physical-device qualification remains pending under Issue #13 and is not implied by automated simulator/emulator coverage. diff --git a/docs/native/android-getting-started.md b/docs/native/android-getting-started.md index b7f8475..dcb2484 100644 --- a/docs/native/android-getting-started.md +++ b/docs/native/android-getting-started.md @@ -1,20 +1,20 @@ -# Scanly SDK v2.0.1 for Android +# Scanly SDK v2.1.0 for Android -Scanly SDK v2.0.1 is distributed as `scanly-sdk-2.0.1.aar` on the [v2.0.1 GitHub Release](https://github.com/Yangjunjie-Lin/Scanly/releases/tag/v2.0.1). Maven Central is **not published and not required for v2.0.1**; do not use `implementation("io.scanly:scanly-sdk:2.0.1")`. +Scanly SDK v2.1.0 is distributed as `scanly-sdk-2.1.0.aar` on the [v2.1.0 GitHub Release](https://github.com/Yangjunjie-Lin/Scanly/releases/tag/v2.1.0). Maven Central is **not published and not required for v2.1.0**; do not use `implementation("io.scanly:scanly-sdk:2.1.0")`. ## Install the AAR -1. Download `scanly-sdk-2.0.1.aar` from the GitHub Release. -2. Place it at `app/libs/scanly-sdk-2.0.1.aar`. +1. Download `scanly-sdk-2.1.0.aar` from the GitHub Release. +2. Place it at `app/libs/scanly-sdk-2.1.0.aar`. 3. Add the file dependency: ```kotlin dependencies { - implementation(files("libs/scanly-sdk-2.0.1.aar")) + implementation(files("libs/scanly-sdk-2.1.0.aar")) } ``` -Verify the AAR against `release/stable/v2.0.1/checksums.sha256` or the checksum attached to the GitHub Release before integration. +Verify the AAR against `release/stable/v2.1.0/checksums.sha256` or the checksum attached to the GitHub Release before integration. ## CameraX quick start diff --git a/docs/native/architecture.md b/docs/native/architecture.md index 47cb231..64773a4 100644 --- a/docs/native/architecture.md +++ b/docs/native/architecture.md @@ -1,6 +1,6 @@ # Native mobile architecture -Scanly SDK v2.0.1 uses one shared ZXing-C++ decode implementation behind a +Scanly SDK v2.1.0 uses one shared ZXing-C++ decode implementation behind a stable C ABI. The web runtime continues to use the pinned ZXing-C++ WASM adapter; Swift and Kotlin do not select independent decoder libraries. @@ -29,7 +29,7 @@ and typed failures. Complex C++ types never cross the ABI. ## Session strategy -v2.0.1 uses the platform-wrapper strategy for frame scheduling, lifecycle, +v2.1.0 uses the platform-wrapper strategy for frame scheduling, lifecycle, latest-frame admission, repeat suppression, and stale-result discard. The portable C++ boundary remains decode-only. Cross-platform session behavior is constrained by deterministic contracts and may be converged further in a future minor release; diff --git a/docs/native/compatibility.md b/docs/native/compatibility.md index 3076ed7..803f383 100644 --- a/docs/native/compatibility.md +++ b/docs/native/compatibility.md @@ -1,21 +1,21 @@ # Native compatibility -Scanly Native SDK v2.0.1 is a Stable software release. Automated build and fixture coverage is verified; post-release physical qualification remains pending. +Scanly Native SDK v2.1.0 is a Stable software release. Automated build and fixture coverage is verified; post-release physical qualification remains pending. | Target | Minimum / ABI | Distribution | Automated verification | Physical status | | --- | --- | --- | --- | --- | -| iOS | iOS 13; Swift tools 5.9; current supported Xcode capable of Swift 5.9 packages | SPM source package at `native/ios` in tag `v2.0.1` | Swift build/test, simulator, unsigned device compilation | `POST_RELEASE_VALIDATION_PENDING` | +| iOS | iOS 13; Swift tools 5.9; current supported Xcode capable of Swift 5.9 packages | SPM source package at `native/ios` in tag `v2.1.0` | Swift build/test, simulator, unsigned device compilation | `POST_RELEASE_VALIDATION_PENDING` | | Android | API 24; Java 17 | GitHub Release AAR | AAR, unit/lint, x86_64 emulator fixture smoke | `POST_RELEASE_VALIDATION_PENDING` | | Android ABI | `arm64-v8a`, `x86_64` | AAR native libraries | both `.so` entries required | `POST_RELEASE_VALIDATION_PENDING` | | `armeabi-v7a` | unsupported | not shipped | omission verified | `unsupported` | Supported public formats are QR Code, Data Matrix, PDF417, Code 128, EAN-13, EAN-8, UPC-A, and UPC-E. Shared native fixtures cover all eight formats plus one two-symbol QR Code + Code 128 image. -Distribution boundaries for v2.0.1: +Distribution boundaries for v2.1.0: - Swift Package Manager source package: shipped under the immutable Git tag; use exact-tag checkout plus the local `native/ios` package path because the repository root has no Package.swift. - Android AAR: shipped through the GitHub Release. - CocoaPods and Maven Central: not published. -- App Store, Google Play, React Native, and Flutter: not SDK distribution channels for v2.0.1. +- App Store, Google Play, React Native, and Flutter: not SDK distribution channels for v2.1.0. Simulator or emulator PASS never implies physical iPhone or Android PASS. Any unavailable toolchain lane reports `NOT_RUN` or `NOT_TESTED`, not PASS. Physical validation continues under [Issue #13](https://github.com/Yangjunjie-Lin/Scanly/issues/13). diff --git a/docs/native/cross-platform-wrapper-plan.md b/docs/native/cross-platform-wrapper-plan.md index 641deda..d834df8 100644 --- a/docs/native/cross-platform-wrapper-plan.md +++ b/docs/native/cross-platform-wrapper-plan.md @@ -1,6 +1,6 @@ # React Native and Flutter wrapper plan -Scanly v2.0.1 does not publish React Native or Flutter adapters. The Native APIs are +Scanly v2.1.0 does not publish React Native or Flutter adapters. The Native APIs are kept wrapper-friendly by using immutable value results, typed platform errors, explicit decoder/session disposal, bounded multiple-result arrays, and the stable C ABI beneath both platforms. @@ -16,4 +16,4 @@ with destroy and must copy borrowed result views before freeing the result set. Before either publication: freeze native API snapshots, run the unified shared fixture vectors, add wrapper lifecycle/memory soak, and complete physical -validation. No wrapper publication is part of v2.0.1. +validation. No wrapper publication is part of v2.1.0. diff --git a/docs/native/ios-getting-started.md b/docs/native/ios-getting-started.md index 83e5ce6..4ce4852 100644 --- a/docs/native/ios-getting-started.md +++ b/docs/native/ios-getting-started.md @@ -1,13 +1,13 @@ -# ScanlySDK v2.0.1 for iOS +# ScanlySDK v2.1.0 for iOS -ScanlySDK v2.0.1 is a Stable Swift Package Manager source package for iOS 13+. CocoaPods is not a v2.0.1 distribution channel. +ScanlySDK v2.1.0 is a Stable Swift Package Manager source package for iOS 13+. CocoaPods is not a v2.1.0 distribution channel. ## Install from the immutable tag -The package manifest lives at `native/ios/Package.swift`, not the repository root. Swift Package Manager cannot resolve this repository as a remote versioned dependency using the root Git URL. For v2.0.1, check out the immutable tag and add the subdirectory as a local package: +The package manifest lives at `native/ios/Package.swift`, not the repository root. Swift Package Manager cannot resolve this repository as a remote versioned dependency using the root Git URL. For v2.1.0, check out the immutable tag and add the subdirectory as a local package: ```bash -git clone --branch v2.0.1 --depth 1 https://github.com/Yangjunjie-Lin/Scanly.git +git clone --branch v2.1.0 --depth 1 https://github.com/Yangjunjie-Lin/Scanly.git ``` In Xcode choose **File → Add Package Dependencies → Add Local** and select `Scanly/native/ios`, then add the `ScanlySDK` product to the app target. A Package.swift-based host can use a local path: @@ -18,7 +18,7 @@ dependencies: [ ] ``` -The checked-out `v2.0.1` tag is the version pin. Standard remote root-URL resolution such as `.package(url: ..., from: "2.0.1")` requires a root package manifest and is not supported by this repository layout. +The checked-out `v2.1.0` tag is the version pin. Standard remote root-URL resolution such as `.package(url: ..., from: "2.1.0")` requires a root package manifest and is not supported by this repository layout. ## Decode diff --git a/docs/platform-compatibility.md b/docs/platform-compatibility.md index f46aae7..aa6c363 100644 --- a/docs/platform-compatibility.md +++ b/docs/platform-compatibility.md @@ -1,6 +1,6 @@ # Platform compatibility matrix -Scanly v2.0.1 is the current Stable software line. The physical matrix below remains the post-release v2.0.0 qualification program tracked by Issue #13, not a publication gate and not a physical PASS claim for v2.0.1. +Scanly v2.1.0 is the current Stable software line. The physical matrix below remains the post-release v2.0.0 qualification program tracked by Issue #13, not a publication gate and not a physical PASS claim for v2.1.0. Allowed runtime statuses are `verified`, `partially-verified`, `unsupported`, `unavailable`, and `not-tested`. `verified` means automated evidence unless a row explicitly identifies an admitted physical session. diff --git a/docs/releases/v2.1.0.md b/docs/releases/v2.1.0.md index 86dcd2d..51c4bf4 100644 --- a/docs/releases/v2.1.0.md +++ b/docs/releases/v2.1.0.md @@ -1,6 +1,6 @@ # Scanly SDK v2.1.0 -Status: release-qualified candidate. Registry publication and post-publication verification are tracked separately; this document is not a publication record. +Status: published Stable release. All 11 npm packages have `latest=2.1.0`, exact downloaded artifact bytes, and cryptographically verified Registry provenance. See the [immutable publication record](../../release/stable/v2.1.0/v2.1.0-publication-record.json) for the signed tag, GitHub Release, artifact, provenance and production identities. Physical validation remains pending under Issue #13. ## New: Link Intelligence @@ -22,11 +22,11 @@ Remote URL inspection uses SSRF controls. LLM output is advisory. Threat-intelli ## Compatibility -Existing v2 scanner APIs remain compatible. URL intelligence is an independent, default-disabled module, not part of decoder scheduling. Native version metadata advances with the release line; Native build/signing/artifact qualification must be repeated before publication. Existing Native evidence is not rebranded as 2.1.0 evidence. +Existing v2 scanner APIs remain compatible. URL intelligence is an independent, default-disabled module, not part of decoder scheduling. Native build/signing/artifact qualification was repeated for this release, including two independent exact-source builds; existing Native evidence was not rebranded as 2.1.0 evidence. ## Qualification -All software, browser, API/package, security, Native, SBOM/license, artifact/reproducibility, signing and publication gates must pass on the final release identity. Feature-branch test results are development evidence only. See [URL safety architecture](../url-safety.md) and the candidate qualification record when available. Issue #13 remains independent. +Software, browser, API/package, security, Native, SBOM/license, artifact/reproducibility, signing and publication checks passed. The [frozen qualification manifest](../../release/stable/v2.1.0/v2.1.0-manifest.json) binds the exact product source and its evidence; the separate publication record binds the actual published identities. Feature-branch test results remain development evidence only. See [URL safety architecture](../url-safety.md). Issue #13 remains independent. The Stable manifest generator refuses new-version generation without `STABLE_QUALIFICATION_RECORD`: an exact-source `scanly-release-qualification-1` record with version, sourceCommit, sourceTree and content-addressed PASS evidence (`path`, `sha256`, `sourceCommit`) for software, apiAbi, security, sbom, licenses, native, npmReproducibility, signing, publicationCredentials and deployment. Fresh public signing metadata and two independent npm build/hash maps are required. Legacy 2.0.x GO/credential/reproducibility claims cannot be inherited. @@ -39,3 +39,7 @@ The first Registry submission was rejected with E422: although the original Sigs [The additive recovery record](../../release/stable/v2.1.0/v2.1.0-provenance-recovery.json) preserves this failure and binds replacement proofs to two fresh independent GitHub-hosted builds. All 11 rebuilt tarballs match the frozen release byte-for-byte; all 22 replacement bundles are signature-, identity-, and subject-verified. The workflow source is now first and the exact product source remains a separate explicit dependency. The signed tag, original manifest, original provenance, and frozen artifacts remain unchanged. Use `npm run stable:bootstrap -- --qualified-provenance-recovery` only with this verified additive record. The command rechecks the live successful workflow, both independent signed URL Safety bundles, exact artifact hashes, original qualification, and owner authentication before requesting publication. A completed build or local signature check is not proof of Registry acceptance; post-publication checks remain mandatory. + +Registry acceptance of the corrected proof and all 11 downloaded packages was subsequently verified. The URL Safety attestation identifies build run `34754673547`; the existing ten packages identify OIDC publication run `34726283486`. The initial post-publish 404 was a Registry propagation delay and resolved without republishing. New-package Trusted Publisher setup is a separate maintenance authorization, not the source of this first-publication provenance. + +The publication record lists the 27 GitHub Release assets and their actual SHA-256 digests. The standalone `THIRD_PARTY_NOTICES` asset uses CRLF checkout line endings (its text matches the signed tag); the other 26 asset digests match exact signed-tag file bytes. No asset was replaced during this verification. diff --git a/docs/sdk/api-stability.md b/docs/sdk/api-stability.md index 0750101..9b305d5 100644 --- a/docs/sdk/api-stability.md +++ b/docs/sdk/api-stability.md @@ -1,14 +1,14 @@ # Public API stability -Scanly SDK v2.0.1 classifies public APIs as Stable, Experimental, or Internal. `ScannerSession`, +Scanly SDK v2.1.0 classifies public APIs as Stable, Experimental, or Internal. `ScannerSession`, `BarcodeTracker`, and `BatchScanSession` are Stable. The DPM profile is Experimental and opt-in. Recovery implementations, worker internals, and camera implementation details are Internal. CaptureRouter remains the authoritative execution boundary. Public declarations and export maps for core, -browser, node, react, scenario schema, and engine packages are hashed in +browser, node, react, parsers, URL Safety, scenario schema, and engine packages are hashed in `api-snapshots/public-api.json`. -CI rebuilds declarations and fails on an unexpected snapshot change. Intentional +CI rebuilds declarations and fails on an unexpected snapshot change. Intentional public API changes require semantic-version classification, declaration review, migration notes, and an explicit snapshot update. Native ESM import and installed-tarball checks remain separate gates. The C ABI snapshot additionally checks exported @@ -17,4 +17,4 @@ symbols, enum values, and normalized struct layouts. Internal attempt plans, coordinate matrices, benchmark fixture results, and camera `InternalTrack` state are not promoted to application contracts. Registries remain extension APIs with explicit register/replace/dispose lifecycle -rules. Breaking changes after v2.0.0 require a new major release and qualification cycle. v2.0.1 changes only exported version-literal values; it adds no public API member or state variant. +rules. Breaking changes after v2.0.0 require a new major release and qualification cycle. v2.1.0 adds the backward-compatible, optional `@scanly/url-safety` package and its Node-only `/server` entry; existing scanner APIs remain compatible. URL Safety has its own analysis status and never adds AI latency or failure to the barcode decoding state machine. See [Link Intelligence](../url-safety.md). diff --git a/docs/sdk/public-api.md b/docs/sdk/public-api.md index d40f7d5..d879d1e 100644 --- a/docs/sdk/public-api.md +++ b/docs/sdk/public-api.md @@ -2,10 +2,12 @@ ## Version policy -- SDK package version: `2.0.1` (Stable patch release; physical validation pending) +- SDK package version: `2.1.0` (Stable minor release; physical validation pending) ## Camera platform surface +The optional `@scanly/url-safety` package provides local analysis, a deterministic risk engine, client/cache/controller APIs, and a separate Node-only `/server` analyzer with provider adapters and safe fetching. It is not part of the scanner's default decode pipeline. See the [URL Safety API and integration guide](../url-safety.md). + `@scanly/browser` exports `CameraConstraintPolicy`, `DeviceDiagnostics`, `CameraRecoveryPolicy`, and `CameraRecoveryController`. Constraint negotiation requests ideal facing mode, resolution, and frame rate, then removes optional preferences through a bounded fallback sequence. An explicit device ID remains exact unless the caller deliberately chooses ideal matching. `ScannerSession.getDeviceDiagnostics()` returns camera API reports without filling missing fields. Camera lifecycle events invalidate generations so results from an old camera, orientation, resolution, or background interval cannot become new public state. Recovery is bounded; exhausted recovery produces `camera_recovery_failed`. @@ -85,7 +87,7 @@ Historical real-time development evidence uses 20 scenario-specific Ground Truth `npm run api:snapshot` and `npm run api:diff` validate the package-root declarations. Their presence here does not assert that a particular GitHub PR head has passed the Public API workflow. -The v2.0.1 Stable APIs follow semantic versioning. Supported deprecated APIs receive at least one minor-release migration window unless a security fix requires removal. +The v2.1.0 Stable APIs follow semantic versioning. Supported deprecated APIs receive at least one minor-release migration window unless a security fix requires removal. ## Authoritative execution API @@ -128,6 +130,6 @@ When `output.includeAttempts` is enabled, `attempts` contains a bounded, payload ## Supported capability versus vocabulary -Scanly SDK v2.0.1 publicly supports `qr_code`, `data_matrix`, `pdf417`, `code_128`, `ean_13`, `ean_8`, `upc_a`, and `upc_e`. Deferred ZXing formats are not in the public union. jsQR and ZXing-JS report QR-only capabilities; the pinned ZXing-C++ WASM engine reports the eight verified mappings. A scenario requesting a format with no registered engine returns `unsupported_format` during compilation. +Scanly SDK v2.1.0 publicly supports `qr_code`, `data_matrix`, `pdf417`, `code_128`, `ean_13`, `ean_8`, `upc_a`, and `upc_e`. Deferred ZXing formats are not in the public union. jsQR and ZXing-JS report QR-only capabilities; the pinned ZXing-C++ WASM engine reports the eight verified mappings. A scenario requesting a format with no registered engine returns `unsupported_format` during compilation. `FormatSelection` accepts a non-empty list, normalizes duplicates, rejects deferred/unknown formats, and is propagated through Router, Worker, Node, and native decode options. QR-only remains the default when no explicit selection or non-QR scenario is supplied. diff --git a/docs/sdk/usage.md b/docs/sdk/usage.md index b2b4f14..5040344 100644 --- a/docs/sdk/usage.md +++ b/docs/sdk/usage.md @@ -1,6 +1,6 @@ -# Scanly SDK v2.0.1 usage +# Scanly SDK v2.1.0 usage -Scanly SDK v2.0.1 packages are published Stable packages. Browser, Node, and React packages declare all required Scanly dependencies; install only the public runtime package your application uses. +Scanly SDK v2.1.0 packages are published Stable packages. Browser, Node, and React packages declare all required Scanly dependencies; install only the public runtime package your application uses. ## Browser diff --git a/docs/sdk/worker-deployment.md b/docs/sdk/worker-deployment.md index 9dbabb5..b56455b 100644 --- a/docs/sdk/worker-deployment.md +++ b/docs/sdk/worker-deployment.md @@ -1,6 +1,6 @@ # Worker and WASM deployment -`@scanly/browser` v2.0.1 creates a module Worker with a relative ESM asset URL. The package emits `dist/worker/decode-worker.js`; bundlers must copy or chunk the Worker and the packaged ZXing-C++ WASM asset into the application deployment. +`@scanly/browser` v2.1.0 creates a module Worker with a relative ESM asset URL. The package emits `dist/worker/decode-worker.js`; bundlers must copy or chunk the Worker and the packaged ZXing-C++ WASM asset into the application deployment. The default Browser composition is jsQR → lazy ZXing-C++ WASM → ZXing-JS. Worker ownership is persistent across scans and releases when the session is disposed. Terminating a Worker rejects pending work, prevents stale delivery, and releases its WASM realm; cancellation during synchronous native execution suppresses late delivery rather than preempting native code. diff --git a/release/stable/v2.1.0/v2.1.0-publication-record.json b/release/stable/v2.1.0/v2.1.0-publication-record.json new file mode 100644 index 0000000..7f5f7aa --- /dev/null +++ b/release/stable/v2.1.0/v2.1.0-publication-record.json @@ -0,0 +1,464 @@ +{ + "schemaVersion": "scanly-stable-publication-record-1", + "version": "2.1.0", + "qualificationManifest": { + "path": "release/stable/v2.1.0/v2.1.0-manifest.json", + "sha256": "89faaff164bafde1033264380f5d19b7c1c168f97d4fc4120a4f4c695686e142" + }, + "gitTag": { + "name": "v2.1.0", + "object": "18874fffe7380190ac36d01128ed69f8c6e0dd69", + "target": "d825d32051514a69f07e545e5a52ad6a73cffef7", + "objectType": "tag", + "signing": { + "status": "GITHUB_VERIFIED", + "verified": true, + "reason": "valid", + "verifiedAt": "2026-09-12T23:45:28Z" + } + }, + "githubRelease": { + "id": 387738256, + "tag": "v2.1.0", + "name": "Scanly SDK v2.1.0 — Link Intelligence", + "publishedAt": "2026-09-12T23:46:22Z", + "url": "https://github.com/Yangjunjie-Lin/Scanly/releases/tag/v2.1.0", + "draft": false, + "prerelease": false, + "assetsVerified": [ + { + "id": 560161821, + "name": "artifact-manifest.json", + "size": 10239, + "digest": "sha256:9b7b07cc8d23950ffb0c6b26b4c10f706f42a6338c2cc27dfe228f762badddc4" + }, + { + "id": 560161823, + "name": "checksums.sha256", + "size": 1611, + "digest": "sha256:b13da82604a1aacc247e38247bf3c7987b5ddf2760c82402ba5a0d175595a83b" + }, + { + "id": 560161826, + "name": "license-inventory.json", + "size": 79377, + "digest": "sha256:929a90ce66b7605fdb09ddd6aabbc2780c8a9aeb97867df030517234d6fd00ff" + }, + { + "id": 560161852, + "name": "Package.swift", + "size": 1180, + "digest": "sha256:24d04f5d3a67c55aee95af7b4bf158f359a0c4b4da3f37b7df173269bd9af66f" + }, + { + "id": 560161822, + "name": "physical-validation-status.json", + "size": 1101, + "digest": "sha256:c7dc34a4f7517e83a5c120700898e8ebbb90fa49464c19415205144a633f99f3" + }, + { + "id": 560161832, + "name": "publication-credentials.json", + "size": 4005, + "digest": "sha256:6e1b1df97fc4fa822ecc7182840ddcf3c910b315d61204d50c9bd1b70d60ba2d" + }, + { + "id": 560161839, + "name": "qualification-input.json", + "size": 15611, + "digest": "sha256:a42ec5c90457b5f14290ac585e083bbb63e74f540110b05771b90a1bcc8272d6" + }, + { + "id": 560161834, + "name": "release-policy.json", + "size": 890, + "digest": "sha256:a0599ed33282bd6361cf0bd979369c3b553fe7a2cd7f3c8b09df61e172bbb49d" + }, + { + "id": 560161830, + "name": "reproducibility.json", + "size": 6886, + "digest": "sha256:21e10a04433ba57c6d1396bc13126e75cc29c2d7d1b1f21f1e2562468738b2a3" + }, + { + "id": 560161820, + "name": "sbom.cdx.json", + "size": 122332, + "digest": "sha256:2b204af3904f6994eb4c69535cbdda4e79cb320f89dc09b798e87dfc0bd99697" + }, + { + "id": 560161862, + "name": "scanly-benchmark-2.1.0.tgz", + "size": 12489, + "digest": "sha256:468b1cf37bf229029651fa1e6d6ec63414902578ea1f34b1f8632704ee47e9dd" + }, + { + "id": 560161864, + "name": "scanly-browser-2.1.0.tgz", + "size": 112845, + "digest": "sha256:c173f88dab2a0402ee549c9e609868c2b50145a8096ecc3c0c668a2823b92727" + }, + { + "id": 560161865, + "name": "scanly-core-2.1.0.tgz", + "size": 133351, + "digest": "sha256:7a529c1c940ace1d961bd1df668f668623bcbac1527827579433efffeb10e416" + }, + { + "id": 560161851, + "name": "scanly-core.h", + "size": 8005, + "digest": "sha256:82dee124d9b88e8ee2c9ea6727a83a3a9e08fb6b70ca753c404928d70624d07a" + }, + { + "id": 560161866, + "name": "scanly-engine-jsqr-2.1.0.tgz", + "size": 2737, + "digest": "sha256:b530dcb7949290f068fa3dd3805c0ee23b26d4554cc920f058f1c6c6f3afc68b" + }, + { + "id": 560161869, + "name": "scanly-engine-zxing-cpp-wasm-2.1.0.tgz", + "size": 472873, + "digest": "sha256:5215d8e09ff67ea07cececae51d34a975ae0396723ab235c627081568b1b796c" + }, + { + "id": 560161875, + "name": "scanly-engine-zxing-js-2.1.0.tgz", + "size": 3188, + "digest": "sha256:420c12ac6a7170c004cee7ce25af9e69f56165b1d50e31ebb1acf4eb03b2eecf" + }, + { + "id": 560161879, + "name": "scanly-node-2.1.0.tgz", + "size": 4163, + "digest": "sha256:13207d6afba9038cf721bb9462ff096aedaa658ed22596c10f5529eb08fc3573" + }, + { + "id": 560161878, + "name": "scanly-parsers-2.1.0.tgz", + "size": 5415, + "digest": "sha256:2d71b9713d1b8d084b8c9bdeb0ffbe079b3df54a16488e50dabe857c374cb868" + }, + { + "id": 560161882, + "name": "scanly-react-2.1.0.tgz", + "size": 2873, + "digest": "sha256:e709ec6f963a91f593a55efcda65e5cf524774154496a1011d8474bb7ab9b8ff" + }, + { + "id": 560161885, + "name": "scanly-scenario-schema-2.1.0.tgz", + "size": 10376, + "digest": "sha256:b55e951e1fcd5e129200beab60ee057dee23d4694409df75d007c0953a7e90b1" + }, + { + "id": 560161848, + "name": "scanly-sdk-2.1.0.aar", + "size": 1221160, + "digest": "sha256:44297a5a8b89762a68ccdde61cf107661c8dc7e2b6eb1117f534ce1c67c5098b" + }, + { + "id": 560161891, + "name": "scanly-url-safety-2.1.0.tgz", + "size": 35468, + "digest": "sha256:72bbd5974b2a0b0c2c1ded6098c249084df0fbffe50a937ef96e68902b914a87" + }, + { + "id": 560161831, + "name": "signing-manifest.json", + "size": 3631, + "digest": "sha256:dc435518ff3ce80ecabb6ff6780df7a63648bdadcf3903aafadc3f2393d81987" + }, + { + "id": 560161858, + "name": "THIRD_PARTY_NOTICES", + "size": 968, + "digest": "sha256:d6150ff4b3ae92eb261e61f958f718c13933cdbb3887f4f3b25c06d2fd18c9e8" + }, + { + "id": 560161847, + "name": "v2.1.0-manifest.json", + "size": 5055, + "digest": "sha256:89faaff164bafde1033264380f5d19b7c1c168f97d4fc4120a4f4c695686e142" + }, + { + "id": 560161845, + "name": "v2.1.0-manifest.json.sha256", + "size": 87, + "digest": "sha256:1c91413877b841aab01df952d18f66fd3555adda7bdbcb9184adaa623a7f35bc" + } + ] + }, + "npm": [ + { + "name": "@scanly/benchmark", + "version": "2.1.0", + "distTag": "latest", + "distTagVersion": "2.1.0", + "registry": "https://registry.npmjs.org/", + "published": true, + "provenance": "VERIFIED_ATTESTATION_PRESENT", + "integrity": "sha512-biYsH3DfjMA9MPjQltfPP8+685LV6ef+pKw9pNPQmPlcnwZLanXHOLSemEtBdrHit6DWSOh3vGJhlivL7GDVzw==", + "attestationUrl": "https://registry.npmjs.org/-/npm/v1/attestations/@scanly%2fbenchmark@2.1.0", + "provenanceIdentity": { + "workflow": { + "ref": "refs/tags/v2.1.0", + "repository": "https://github.com/Yangjunjie-Lin/Scanly", + "path": ".github/workflows/stable-npm-publish.yml" + }, + "invocationId": "https://github.com/Yangjunjie-Lin/Scanly/actions/runs/34726283486/attempts/1", + "bundleSha256": "5eff3dde07f58f79bddd44c5ca4956701c24c8b76e9b74c57629ec95697f6e6d" + } + }, + { + "name": "@scanly/browser", + "version": "2.1.0", + "distTag": "latest", + "distTagVersion": "2.1.0", + "registry": "https://registry.npmjs.org/", + "published": true, + "provenance": "VERIFIED_ATTESTATION_PRESENT", + "integrity": "sha512-B/+iB6oqgmCbDoCK6SIcPHc1kEBrP+Ed1F5M+YQPwWIXDkLv2o2C73Kzm58zMI6E24GKAjnlY7N8ZtAIx2jPPg==", + "attestationUrl": "https://registry.npmjs.org/-/npm/v1/attestations/@scanly%2fbrowser@2.1.0", + "provenanceIdentity": { + "workflow": { + "ref": "refs/tags/v2.1.0", + "repository": "https://github.com/Yangjunjie-Lin/Scanly", + "path": ".github/workflows/stable-npm-publish.yml" + }, + "invocationId": "https://github.com/Yangjunjie-Lin/Scanly/actions/runs/34726283486/attempts/1", + "bundleSha256": "16de0a38bc9669256a060d56b416780ea69876a64f4c39920baf124a8eed46c3" + } + }, + { + "name": "@scanly/core", + "version": "2.1.0", + "distTag": "latest", + "distTagVersion": "2.1.0", + "registry": "https://registry.npmjs.org/", + "published": true, + "provenance": "VERIFIED_ATTESTATION_PRESENT", + "integrity": "sha512-xqgSMSh/jJt6fjBIH2XUl0lncbAD19MRSgvHzewDuqyAG6psCVl4uR139I7EiaAyBVCCic383um3Kl6OrRDivQ==", + "attestationUrl": "https://registry.npmjs.org/-/npm/v1/attestations/@scanly%2fcore@2.1.0", + "provenanceIdentity": { + "workflow": { + "ref": "refs/tags/v2.1.0", + "repository": "https://github.com/Yangjunjie-Lin/Scanly", + "path": ".github/workflows/stable-npm-publish.yml" + }, + "invocationId": "https://github.com/Yangjunjie-Lin/Scanly/actions/runs/34726283486/attempts/1", + "bundleSha256": "c0b7183cda254ba4c8ddc80f4920f7a0a8626c3ba7ecb2c69da0bd9b4baf42d1" + } + }, + { + "name": "@scanly/engine-jsqr", + "version": "2.1.0", + "distTag": "latest", + "distTagVersion": "2.1.0", + "registry": "https://registry.npmjs.org/", + "published": true, + "provenance": "VERIFIED_ATTESTATION_PRESENT", + "integrity": "sha512-RVCntWGW4/aG3kHPJ4+fKMmp1XzLbmJ3oP9wfs2EIsJNC6U/Y4UdGBtLCLYgJvxdKzGRxSK8nDjXdFoNWIVNNQ==", + "attestationUrl": "https://registry.npmjs.org/-/npm/v1/attestations/@scanly%2fengine-jsqr@2.1.0", + "provenanceIdentity": { + "workflow": { + "ref": "refs/tags/v2.1.0", + "repository": "https://github.com/Yangjunjie-Lin/Scanly", + "path": ".github/workflows/stable-npm-publish.yml" + }, + "invocationId": "https://github.com/Yangjunjie-Lin/Scanly/actions/runs/34726283486/attempts/1", + "bundleSha256": "a51d9e9557e760d922a30ad1b1ece539eaa4b62393c859f873d9802b09cb0e66" + } + }, + { + "name": "@scanly/engine-zxing-cpp-wasm", + "version": "2.1.0", + "distTag": "latest", + "distTagVersion": "2.1.0", + "registry": "https://registry.npmjs.org/", + "published": true, + "provenance": "VERIFIED_ATTESTATION_PRESENT", + "integrity": "sha512-RnNMScwHdrJu3B+mJh94oCim3Q7JenQzzSIQFkiDb666BMVH6QUQNy+n2kEz0DA/hRGM7CsXEAWBoWDLBHu8OQ==", + "attestationUrl": "https://registry.npmjs.org/-/npm/v1/attestations/@scanly%2fengine-zxing-cpp-wasm@2.1.0", + "provenanceIdentity": { + "workflow": { + "ref": "refs/tags/v2.1.0", + "repository": "https://github.com/Yangjunjie-Lin/Scanly", + "path": ".github/workflows/stable-npm-publish.yml" + }, + "invocationId": "https://github.com/Yangjunjie-Lin/Scanly/actions/runs/34726283486/attempts/1", + "bundleSha256": "019411aa1013eee30ac277d51a20adc7cb677c0813cea920127e0b7000da41d3" + } + }, + { + "name": "@scanly/engine-zxing-js", + "version": "2.1.0", + "distTag": "latest", + "distTagVersion": "2.1.0", + "registry": "https://registry.npmjs.org/", + "published": true, + "provenance": "VERIFIED_ATTESTATION_PRESENT", + "integrity": "sha512-SafGPd9jF7lmLxvkXZK46pKJ+7UdTTZKXB4+iZ6CEBr9Jo0mqK8ly4pzm9TSE/I+pJnUy1sA6V//bcfPzw0P2g==", + "attestationUrl": "https://registry.npmjs.org/-/npm/v1/attestations/@scanly%2fengine-zxing-js@2.1.0", + "provenanceIdentity": { + "workflow": { + "ref": "refs/tags/v2.1.0", + "repository": "https://github.com/Yangjunjie-Lin/Scanly", + "path": ".github/workflows/stable-npm-publish.yml" + }, + "invocationId": "https://github.com/Yangjunjie-Lin/Scanly/actions/runs/34726283486/attempts/1", + "bundleSha256": "a4f53ba31bf0070319889845ed6a56157a602991cbc283b15aeb503ae144cade" + } + }, + { + "name": "@scanly/node", + "version": "2.1.0", + "distTag": "latest", + "distTagVersion": "2.1.0", + "registry": "https://registry.npmjs.org/", + "published": true, + "provenance": "VERIFIED_ATTESTATION_PRESENT", + "integrity": "sha512-iPQEwVnUAKSgPv8AKUrSB23BfbyEslPDP8i3Qrl1vsw11gLp+lKf8MqR3GNRSKgHjVVkiAlzpjxJoqfG0dwzfg==", + "attestationUrl": "https://registry.npmjs.org/-/npm/v1/attestations/@scanly%2fnode@2.1.0", + "provenanceIdentity": { + "workflow": { + "ref": "refs/tags/v2.1.0", + "repository": "https://github.com/Yangjunjie-Lin/Scanly", + "path": ".github/workflows/stable-npm-publish.yml" + }, + "invocationId": "https://github.com/Yangjunjie-Lin/Scanly/actions/runs/34726283486/attempts/1", + "bundleSha256": "9a42fc108d733928e8015559ba2385276c540aad58c0cc984237a4cab28d525b" + } + }, + { + "name": "@scanly/parsers", + "version": "2.1.0", + "distTag": "latest", + "distTagVersion": "2.1.0", + "registry": "https://registry.npmjs.org/", + "published": true, + "provenance": "VERIFIED_ATTESTATION_PRESENT", + "integrity": "sha512-GqaDNAfp0mrQKxYPJTeW5z2VF8XJql1tZHlfzMN1kfTRmX9EP/W6NPDAX+o1ybsheyORb0skGO8E8Jmoi1lHVQ==", + "attestationUrl": "https://registry.npmjs.org/-/npm/v1/attestations/@scanly%2fparsers@2.1.0", + "provenanceIdentity": { + "workflow": { + "ref": "refs/tags/v2.1.0", + "repository": "https://github.com/Yangjunjie-Lin/Scanly", + "path": ".github/workflows/stable-npm-publish.yml" + }, + "invocationId": "https://github.com/Yangjunjie-Lin/Scanly/actions/runs/34726283486/attempts/1", + "bundleSha256": "f0ced465bed2864781f02e1efb6ed98b2cf565c5c8eee6308da2390c22f3dd8f" + } + }, + { + "name": "@scanly/react", + "version": "2.1.0", + "distTag": "latest", + "distTagVersion": "2.1.0", + "registry": "https://registry.npmjs.org/", + "published": true, + "provenance": "VERIFIED_ATTESTATION_PRESENT", + "integrity": "sha512-jCuO6QiqCXznwTKk+9NnHhJkZl7UzTSn3jzFIYjoAKy9LdjSVc2xD3hraGODENgwGhH7bIxxt+CAvaiHQfCklw==", + "attestationUrl": "https://registry.npmjs.org/-/npm/v1/attestations/@scanly%2freact@2.1.0", + "provenanceIdentity": { + "workflow": { + "ref": "refs/tags/v2.1.0", + "repository": "https://github.com/Yangjunjie-Lin/Scanly", + "path": ".github/workflows/stable-npm-publish.yml" + }, + "invocationId": "https://github.com/Yangjunjie-Lin/Scanly/actions/runs/34726283486/attempts/1", + "bundleSha256": "a11b9765753ff2d6967848a2303ba0f3fe0f930e602a551ccea53229eece6a6d" + } + }, + { + "name": "@scanly/scenario-schema", + "version": "2.1.0", + "distTag": "latest", + "distTagVersion": "2.1.0", + "registry": "https://registry.npmjs.org/", + "published": true, + "provenance": "VERIFIED_ATTESTATION_PRESENT", + "integrity": "sha512-lz/Do4epePj1LmOoL1dM+CnCvdErtbCtf1dmIG6GECadDmmq6Q60X1YPeUqSI/lCIBDVS8ikDoKuMsAnRo7dvg==", + "attestationUrl": "https://registry.npmjs.org/-/npm/v1/attestations/@scanly%2fscenario-schema@2.1.0", + "provenanceIdentity": { + "workflow": { + "ref": "refs/tags/v2.1.0", + "repository": "https://github.com/Yangjunjie-Lin/Scanly", + "path": ".github/workflows/stable-npm-publish.yml" + }, + "invocationId": "https://github.com/Yangjunjie-Lin/Scanly/actions/runs/34726283486/attempts/1", + "bundleSha256": "e74df0562165462a689a0cf7d56cbc95d09ac6f449b67015923daaa80fc5a29a" + } + }, + { + "name": "@scanly/url-safety", + "version": "2.1.0", + "distTag": "latest", + "distTagVersion": "2.1.0", + "registry": "https://registry.npmjs.org/", + "published": true, + "provenance": "VERIFIED_ATTESTATION_PRESENT", + "integrity": "sha512-Jp4vLtfbtxkmserzPgbfjtF88aCqFrdBJS+ixZo5KViNdUnlqmZV0UK/8bGYA9uK1b85SVYt9NZeulOoTVMcXg==", + "attestationUrl": "https://registry.npmjs.org/-/npm/v1/attestations/@scanly%2furl-safety@2.1.0", + "provenanceIdentity": { + "workflow": { + "ref": "refs/heads/codex/v2.1-npm-provenance-recovery", + "repository": "https://github.com/Yangjunjie-Lin/Scanly", + "path": ".github/workflows/v2.1-artifact-qualification.yml" + }, + "invocationId": "https://github.com/Yangjunjie-Lin/Scanly/actions/runs/34754673547/attempts/1", + "bundleSha256": "9efc900e995d0f33c17625dbc8c5c2c281e50844250c3a0e2da3ff28a6add0d3" + } + } + ], + "spm": { + "tag": "v2.1.0", + "packageSwiftPath": "native/ios/Package.swift", + "artifactPackageSwiftPath": "release/stable/v2.1.0/artifacts/ios/Package.swift", + "artifactPackageSwiftSha256": "24d04f5d3a67c55aee95af7b4bf158f359a0c4b4da3f37b7df173269bd9af66f", + "resolutionStatus": "SOURCE_PACKAGE_MANIFEST_VERIFIED", + "remoteRootVersionResolution": "UNSUPPORTED_REPOSITORY_LAYOUT_USE_EXACT_TAG_CHECKOUT" + }, + "android": { + "distribution": "GITHUB_RELEASE_ASSET", + "releaseAssetId": 560161848, + "filename": "scanly-sdk-2.1.0.aar", + "url": "https://github.com/Yangjunjie-Lin/Scanly/releases/download/v2.1.0/scanly-sdk-2.1.0.aar", + "sha256": "44297a5a8b89762a68ccdde61cf107661c8dc7e2b6eb1117f534ce1c67c5098b", + "size": 1221160, + "mavenCentral": "NOT_PUBLISHED_FOR_V2.1.0" + }, + "web": { + "productionUrl": "https://qr-decoder-theta.vercel.app", + "deploymentUrl": "https://qr-decoder-q1l35nlrl-yangjunjie-lins-projects.vercel.app", + "deploymentId": "dpl_HxbnobbmCZKiHSZpcVkg1PfWbKeF", + "sourceCommit": "a7a9ae241760ee510acb9f0a0cfcd4801963a0c4", + "status": "READY", + "checkedAt": "2026-09-13T12:05:22.285Z", + "qualifiedDeployment": { + "id": "dpl_ZmfWuc5AHqoSn77tsAWFnyeVmb2Y", + "url": "https://qr-decoder-lpc6qiyx6-yangjunjie-lins-projects.vercel.app", + "sourceCommit": "6b017b53a4404f4feab776ac111b0ea9dacf2734" + }, + "qualifiedProductFilesUnchanged": true, + "httpStatus": 200 + }, + "physicalValidation": { + "status": "POST_RELEASE_VALIDATION_PENDING", + "issue": 13, + "physicalMobileDeviceCount": 0, + "physicalLongSessionCount": 0 + }, + "createdAt": "2026-09-13T12:05:22.020Z", + "recordedFromGitState": { + "ref": "codex/v2.1-publication-record", + "commit": "a7a9ae241760ee510acb9f0a0cfcd4801963a0c4", + "tree": "63bf1819ab91f4c6a4e0504b5ca0d5ab5ac2d6f4" + }, + "provenanceRecovery": { + "path": "release/stable/v2.1.0/v2.1.0-provenance-recovery.json", + "sha256": "c9abb705c75594780b36a0c9777f13e7110b8c0e87d40715ea50835a8552bb1b", + "runId": 34754673547 + } +} From 78faa4fe6495e58b23e4a8261312811e83769518 Mon Sep 17 00:00:00 2001 From: Yangjunjie Lin Date: Sun, 13 Sep 2026 13:34:25 +0100 Subject: [PATCH 4/6] docs: align current symbology guide with v2.1.0 --- docs/symbologies.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/symbologies.md b/docs/symbologies.md index 240746b..e5359d2 100644 --- a/docs/symbologies.md +++ b/docs/symbologies.md @@ -1,6 +1,6 @@ # Supported barcode formats -Scanly SDK v2.0.1 exposes an explicit eight-format public contract. The default scenario remains `formats: ["qr_code"]` for compatibility; applications opt into additional formats or select a multi-format scenario. +Scanly SDK v2.1.0 exposes an explicit eight-format public contract. The default scenario remains `formats: ["qr_code"]` for compatibility; applications opt into additional formats or select a multi-format scenario. | Format | Public ID | Class | Default engine support | Notes | | --- | --- | --- | --- | --- | @@ -21,7 +21,7 @@ const router = createNodeCaptureRouter({ }); ``` -Deferred formats—including Micro QR, rMQR, Aztec, Micro PDF417, DotCode, MaxiCode, GS1 DataBar/Composite, postal codes, Codabar, Code 39, Code 93, and ITF—are not part of the v2.0.x public union. Upstream ZXing support does not make a format public. +Deferred formats—including Micro QR, rMQR, Aztec, Micro PDF417, DotCode, MaxiCode, GS1 DataBar/Composite, postal codes, Codabar, Code 39, Code 93, and ITF—are not part of the v2.1.0 public union. Upstream ZXing support does not make a format public. Direct Part Mark Data Matrix uses the opt-in `dpm-experimental` recovery profile. It is not DPM or industrial certification. Difficult, occluded, low-contrast, or strongly distorted symbols can still fail. From 14c809d3cf4e164647ab2137a102f141495f9b6d Mon Sep 17 00:00:00 2001 From: Yangjunjie Lin Date: Sun, 13 Sep 2026 13:59:32 +0100 Subject: [PATCH 5/6] fix(release): verify additive provenance evidence and trigger helper qualification --- .../workflows/v2.1-artifact-qualification.yml | 3 +- scripts/stable-publication-recovery.mjs | 37 ++++++++++++ scripts/verify-stable-publication-record.mjs | 2 + .../unit/stable-publication-recovery.test.ts | 57 +++++++++++++++++++ 4 files changed, 98 insertions(+), 1 deletion(-) create mode 100644 scripts/stable-publication-recovery.mjs create mode 100644 tests/unit/stable-publication-recovery.test.ts diff --git a/.github/workflows/v2.1-artifact-qualification.yml b/.github/workflows/v2.1-artifact-qualification.yml index f5f41c6..877b7a0 100644 --- a/.github/workflows/v2.1-artifact-qualification.yml +++ b/.github/workflows/v2.1-artifact-qualification.yml @@ -2,10 +2,11 @@ name: v2.1 Artifact Qualification on: pull_request: - branches: [develop] + branches: [develop, main] paths: - .github/workflows/v2.1-artifact-qualification.yml - scripts/prepare-v2.1-npm-artifacts.mjs + - scripts/npm-provenance-identity.mjs workflow_dispatch: inputs: source_commit: diff --git a/scripts/stable-publication-recovery.mjs b/scripts/stable-publication-recovery.mjs new file mode 100644 index 0000000..886987c --- /dev/null +++ b/scripts/stable-publication-recovery.mjs @@ -0,0 +1,37 @@ +import assert from "node:assert/strict"; +import crypto from "node:crypto"; + +// Offline, content-addressed verification of the additive Registry correction. +// Historical releases without a correction retain their original checks. +export function verifyPublicationRecovery(record, qualification, readBytes) { + if (record.version !== "2.1.0" && record.provenanceRecovery === undefined) return; + assert.equal(record.version, "2.1.0", "Unsupported provenance recovery version"); + const reference = record.provenanceRecovery; + assert.ok(reference, "v2.1.0 publication requires its additive provenance recovery"); + const expectedPath = "release/stable/v2.1.0/v2.1.0-provenance-recovery.json"; + assert.equal(reference.path, expectedPath, "Recovery reference must use the versioned repository path"); + assert.match(reference.sha256 ?? "", /^[a-f0-9]{64}$/); + const bytes = readBytes(expectedPath); + assert.equal(crypto.createHash("sha256").update(bytes).digest("hex"), reference.sha256, "Recovery file SHA-256 changed"); + const recovery = JSON.parse(bytes.toString("utf8")); + assert.equal(recovery.schemaVersion, "scanly-v2.1-provenance-recovery-1"); + assert.equal(recovery.version, record.version); + assert.equal(recovery.package, "@scanly/url-safety"); + assert.equal(recovery.sourceCommit, qualification.identity.productSourceCommit); + assert.deepEqual(recovery.qualificationManifest, record.qualificationManifest); + assert.ok(Number.isSafeInteger(reference.runId) && reference.runId > 0, "Recovery run ID must be a positive integer"); + assert.equal(recovery.runId, reference.runId, "Recovery run ID changed"); + assert.ok(Number.isSafeInteger(recovery.runAttempt) && recovery.runAttempt > 0); + const publication = record.npm.find((entry) => entry.name === recovery.package); + assert.equal(publication?.provenanceIdentity?.invocationId, `https://github.com/Yangjunjie-Lin/Scanly/actions/runs/${reference.runId}/attempts/${recovery.runAttempt}`, "Published provenance does not identify the recovery run"); + assert.equal(recovery.npmCredentialsUsedByCI, false); + assert.ok(Array.isArray(recovery.evidence) && recovery.evidence.length === 26, "Recovery must retain both build reports, 22 proofs, workflow evidence and reproducibility report"); + const seen = new Set(); + for (const evidence of recovery.evidence) { + assert.ok(typeof evidence.path === "string" && evidence.path.startsWith("release/stable/v2.1.0/publication-recovery/") && !evidence.path.includes("..") && !evidence.path.includes("\\"), "Unsafe recovery evidence path"); + assert.ok(!seen.has(evidence.path), "Duplicate recovery evidence"); seen.add(evidence.path); + assert.match(evidence.sha256 ?? "", /^[a-f0-9]{64}$/); + assert.equal(crypto.createHash("sha256").update(readBytes(evidence.path)).digest("hex"), evidence.sha256, `Recovery evidence changed: ${evidence.path}`); + } + assert.ok(recovery.evidence.some((entry) => entry.path === recovery.replacementProvenance?.path && entry.sha256 === recovery.replacementProvenance.sha256), "Replacement provenance must be covered by the verified evidence set"); +} diff --git a/scripts/verify-stable-publication-record.mjs b/scripts/verify-stable-publication-record.mjs index ea43b34..141d4a5 100644 --- a/scripts/verify-stable-publication-record.mjs +++ b/scripts/verify-stable-publication-record.mjs @@ -2,6 +2,7 @@ import crypto from "node:crypto"; import { execFileSync } from "node:child_process"; import fs from "node:fs"; import path from "node:path"; +import { verifyPublicationRecovery } from "./stable-publication-recovery.mjs"; const root = path.resolve(import.meta.dirname, ".."); const stableRoot = path.join(root, "release", "stable"); @@ -43,6 +44,7 @@ for (const recordPath of recordPaths) { if (sha256(qualificationPath) !== record.qualificationManifest.sha256) fail(`${version}: qualification manifest hash changed.`); if (qualification.version !== version || qualification.stable !== "V2_STABLE_RELEASE_GO") fail(`${version}: qualification identity is not the frozen Stable GO record.`); + verifyPublicationRecovery(record, qualification, (relative) => fs.readFileSync(path.join(root, relative))); const tagObject = git("rev-parse", record.gitTag.name); const tagTarget = git("rev-parse", `${record.gitTag.name}^{}`); diff --git a/tests/unit/stable-publication-recovery.test.ts b/tests/unit/stable-publication-recovery.test.ts new file mode 100644 index 0000000..b5c2964 --- /dev/null +++ b/tests/unit/stable-publication-recovery.test.ts @@ -0,0 +1,57 @@ +import { describe, expect, it } from "vitest"; +import fs from "node:fs"; +import crypto from "node:crypto"; +// @ts-expect-error release-only MJS has no SDK declaration +import { verifyPublicationRecovery } from "../../scripts/stable-publication-recovery.mjs"; + +const root = "release/stable/v2.1.0"; +const publication = () => JSON.parse(fs.readFileSync(`${root}/v2.1.0-publication-record.json`, "utf8")); +const qualification = JSON.parse(fs.readFileSync(`${root}/v2.1.0-manifest.json`, "utf8")); +const readBytes = (file: string) => fs.readFileSync(file); + +describe("immutable publication provenance recovery reference", () => { + it("verifies the actual additive record without rewriting it", () => { + expect(() => verifyPublicationRecovery(publication(), qualification, readBytes)).not.toThrow(); + }); + it.each(["2.0.0", "2.0.1"])("retains historical %s verification without requiring a new record", (version) => { + expect(() => verifyPublicationRecovery({ version }, {}, () => { throw new Error("unexpected read"); })).not.toThrow(); + }); + it("fails if the recovery reference or file is missing", () => { + const record = publication(); delete record.provenanceRecovery; + expect(() => verifyPublicationRecovery(record, qualification, readBytes)).toThrow(); + expect(() => verifyPublicationRecovery(publication(), qualification, () => { throw new Error("ENOENT"); })).toThrow(); + }); + it.each(["path", "sha256", "runId"])("rejects a substituted reference %s", (field) => { + const record = publication(); record.provenanceRecovery[field] = field === "runId" ? 1 : "substituted"; + expect(() => verifyPublicationRecovery(record, qualification, readBytes)).toThrow(); + }); + it("rejects changed bytes even if JSON remains valid", () => { + expect(() => verifyPublicationRecovery(publication(), qualification, (file: string) => Buffer.concat([readBytes(file), Buffer.from(" ")]))).toThrow(/SHA-256/); + }); + it.each(["schemaVersion", "version", "package", "sourceCommit", "runId", "runAttempt"])("validates recovery %s independently of its digest", (field) => { + const record = publication(); const recovery = JSON.parse(readBytes(record.provenanceRecovery.path).toString()); + recovery[field] = field.startsWith("run") ? -1 : "substituted"; + const bytes = Buffer.from(JSON.stringify(recovery)); record.provenanceRecovery.sha256 = crypto.createHash("sha256").update(bytes).digest("hex"); + expect(() => verifyPublicationRecovery(record, qualification, () => bytes)).toThrow(); + }); + it("binds the correction to the published URL Safety attestation", () => { + const record = publication(); record.npm.find((entry: { name: string }) => entry.name === "@scanly/url-safety").provenanceIdentity.invocationId = "substituted"; + expect(() => verifyPublicationRecovery(record, qualification, readBytes)).toThrow(); + }); + it("rejects changes or deletion of any referenced proof", () => { + expect(() => verifyPublicationRecovery(publication(), qualification, (file: string) => file.includes("provenance-B/") ? Buffer.from("changed") : readBytes(file))).toThrow(/evidence changed/); + expect(() => verifyPublicationRecovery(publication(), qualification, (file: string) => { if (file.includes("provenance-A/")) throw new Error("ENOENT"); return readBytes(file); })).toThrow(); + }); + it("rejects an evidence reference outside the versioned recovery directory", () => { + const record = publication(); const recovery = JSON.parse(readBytes(record.provenanceRecovery.path).toString()); + recovery.evidence[0].path = "release/stable/v2.1.0/publication-recovery/../../outside.json"; + const bytes = Buffer.from(JSON.stringify(recovery)); record.provenanceRecovery.sha256 = crypto.createHash("sha256").update(bytes).digest("hex"); + expect(() => verifyPublicationRecovery(record, qualification, (file: string) => file === record.provenanceRecovery.path ? bytes : readBytes(file))).toThrow(/Unsafe/); + }); + it("triggers real artifact qualification for helper-only changes on both maintained branches", () => { + const workflow = fs.readFileSync(".github/workflows/v2.1-artifact-qualification.yml", "utf8"); + const pullRequest = workflow.split(" pull_request:")[1].split(" workflow_dispatch:")[0]; + expect(pullRequest).toContain("branches: [develop, main]"); + expect(pullRequest).toContain("- scripts/npm-provenance-identity.mjs"); + }); +}); From f3c8519fdd9f72a0f471568ce0f2628080f60b0f Mon Sep 17 00:00:00 2001 From: Yangjunjie Lin Date: Sun, 13 Sep 2026 14:12:31 +0100 Subject: [PATCH 6/6] fix(release): preserve original provenance and bind recovered artifact integrity --- scripts/stable-publication-recovery.mjs | 16 ++++++++++++++++ tests/unit/stable-publication-recovery.test.ts | 18 ++++++++++++++++++ 2 files changed, 34 insertions(+) diff --git a/scripts/stable-publication-recovery.mjs b/scripts/stable-publication-recovery.mjs index 886987c..4bdfb18 100644 --- a/scripts/stable-publication-recovery.mjs +++ b/scripts/stable-publication-recovery.mjs @@ -25,6 +25,22 @@ export function verifyPublicationRecovery(record, qualification, readBytes) { const publication = record.npm.find((entry) => entry.name === recovery.package); assert.equal(publication?.provenanceIdentity?.invocationId, `https://github.com/Yangjunjie-Lin/Scanly/actions/runs/${reference.runId}/attempts/${recovery.runAttempt}`, "Published provenance does not identify the recovery run"); assert.equal(recovery.npmCredentialsUsedByCI, false); + // The original proof is outside the replacement evidence directory and is + // deliberately not replaced. Preserve both sides of the additive audit trail. + for (const [key, expected] of [ + ["originalProvenance", "release/stable/v2.1.0/artifacts/provenance/scanly-url-safety-2.1.0.tgz.sigstore.json"], + ["replacementProvenance", "release/stable/v2.1.0/publication-recovery/provenance-A/scanly-url-safety-2.1.0.tgz.sigstore.json"], + ]) { + assert.equal(recovery[key]?.path, expected, `${key} must retain its exact versioned path`); + assert.match(recovery[key].sha256 ?? "", /^[a-f0-9]{64}$/); + assert.equal(crypto.createHash("sha256").update(readBytes(expected)).digest("hex"), recovery[key].sha256, `${key} SHA-256 changed`); + } + assert.equal(recovery.originalProvenance.registryAccepted, false); + assert.equal(recovery.artifact?.path, "release/stable/v2.1.0/artifacts/npm/scanly-url-safety-2.1.0.tgz"); + const artifactBytes = readBytes(recovery.artifact.path); + assert.equal(crypto.createHash("sha256").update(artifactBytes).digest("hex"), recovery.artifact.sha256, "Recovered artifact SHA-256 changed"); + assert.equal(crypto.createHash("sha512").update(artifactBytes).digest("hex"), recovery.artifact.sha512, "Recovered artifact SHA-512 changed"); + assert.equal(publication.integrity, `sha512-${Buffer.from(recovery.artifact.sha512, "hex").toString("base64")}`, "Recovered artifact does not match the published integrity"); assert.ok(Array.isArray(recovery.evidence) && recovery.evidence.length === 26, "Recovery must retain both build reports, 22 proofs, workflow evidence and reproducibility report"); const seen = new Set(); for (const evidence of recovery.evidence) { diff --git a/tests/unit/stable-publication-recovery.test.ts b/tests/unit/stable-publication-recovery.test.ts index b5c2964..90017c5 100644 --- a/tests/unit/stable-publication-recovery.test.ts +++ b/tests/unit/stable-publication-recovery.test.ts @@ -42,6 +42,24 @@ describe("immutable publication provenance recovery reference", () => { expect(() => verifyPublicationRecovery(publication(), qualification, (file: string) => file.includes("provenance-B/") ? Buffer.from("changed") : readBytes(file))).toThrow(/evidence changed/); expect(() => verifyPublicationRecovery(publication(), qualification, (file: string) => { if (file.includes("provenance-A/")) throw new Error("ENOENT"); return readBytes(file); })).toThrow(); }); + it.each(["changed", "missing"])("rejects a %s original proof outside the replacement directory", (mode) => { + const originalPath = `${root}/artifacts/provenance/scanly-url-safety-2.1.0.tgz.sigstore.json`; + expect(() => verifyPublicationRecovery(publication(), qualification, (file: string) => { + if (file !== originalPath) return readBytes(file); + if (mode === "missing") throw new Error("ENOENT"); + return Buffer.from("changed"); + })).toThrow(); + }); + it.each(["originalProvenance", "replacementProvenance", "artifact"])("rejects substituted %s paths even with an updated record digest", (key) => { + const record = publication(); const recovery = JSON.parse(readBytes(record.provenanceRecovery.path).toString()); + recovery[key].path = "substituted"; + const bytes = Buffer.from(JSON.stringify(recovery)); record.provenanceRecovery.sha256 = crypto.createHash("sha256").update(bytes).digest("hex"); + expect(() => verifyPublicationRecovery(record, qualification, (file: string) => file === record.provenanceRecovery.path ? bytes : readBytes(file))).toThrow(); + }); + it("binds the recovery tarball to the published Registry integrity", () => { + const record = publication(); record.npm.find((entry: { name: string }) => entry.name === "@scanly/url-safety").integrity = "sha512-substituted"; + expect(() => verifyPublicationRecovery(record, qualification, readBytes)).toThrow(/published integrity/); + }); it("rejects an evidence reference outside the versioned recovery directory", () => { const record = publication(); const recovery = JSON.parse(readBytes(record.provenanceRecovery.path).toString()); recovery.evidence[0].path = "release/stable/v2.1.0/publication-recovery/../../outside.json";