{ "openapi": "3.1.1", "info": { "title": "Artifact Provenance Explorer API", "version": "1.0.0", "summary": "Verify npm build provenance: Sigstore signature, transparency log, source repo and commit.", "description": "Every endpoint performs the same calculation as the human page and returns inputs, result, units, assumptions, sources, warnings and computedAt. MCP endpoint: /mcp." }, "servers": [ { "url": "https://artifactprovenanceexplorer.usefulweb.site" } ], "paths": { "/api/v1/calculate": { "post": { "operationId": "calculate", "summary": "Verify npm build provenance: Sigstore signature, transparency log, source repo and commit.", "description": "Fetches (or reads pasted) npm registry attestations for a package version, verifies the Sigstore bundles with node:crypto (DSSE signature, Fulcio certificate chain to the pinned Sigstore root, Rekor signed entry timestamp, Merkle inclusion proof and checkpoint), parses the SLSA provenance (builder, workflow, source repository, commit, trigger) and cross-checks it against the package metadata (repository field, gitHead, tarball integrity).\n\nMethodology:\n- Attestations come from https://registry.npmjs.org/-/npm/v1/attestations/@ (or your paste); package metadata from https://registry.npmjs.org//.\n- Each Sigstore bundle is verified locally with node:crypto: the DSSE signature over the pre-authentication encoding (PAE); for provenance the Fulcio leaf certificate must chain to the pinned public-good Sigstore intermediate and root and be valid at the Rekor integratedTime; the publish attestation must be signed by a pinned npm registry key.\n- Transparency: the Rekor signed entry timestamp (SET) and checkpoint are verified against the pinned rekor.sigstore.dev key, the RFC 6962 Merkle inclusion proof must recompute the logged root hash, and the log entry must record the SHA-256 of this exact payload.\n- Cross-checks: in-toto subject = pkg:npm/@; subject SHA-512 = the registry tarball integrity; provenance repository = package.json repository; provenance commit = gitHead; Fulcio certificate extensions (source repository, digest, workflow) = the provenance claims.\n- Trust roots (npm keys, Rekor key, Fulcio certificates) are pinned snapshots from 2026-10-14, not refreshed via Sigstore TUF; rotated keys therefore show as failures, not as forgeries.", "tags": [ "security" ], "x-mcp-tool": "artifact_provenance_explorer", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArtifactProvenanceExplorerInput" }, "examples": { "example1": { "summary": "Pasted attestations for sigstore@3.0.0 (offline)", "value": { "attestations": "{\"attestations\":[{\"predicateType\":\"https://github.com/npm/attestation/tree/main/specs/publish/v0.1\",\"bundle\":{\"mediaType\":\"application/vnd.dev.sigstore.bundle+json;version=0.2\",\"verificationMaterial\":{\"publicKey\":{\"hint\":\"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA\"},\"tlogEntries\":[{\"logIndex\":\"139985246\",\"logId\":{\"keyId\":\"wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=\"},\"kindVersion\":{\"kind\":\"intoto\",\"version\":\"0.0.2\"},\"integratedTime\":\"1728922429\",\"inclusionPromise\":{\"signedEntryTimestamp\":\"MEUCIQCPv6SdeeKeVR0qcmXMuRzhh/zvFcX/f9b7BABIS/m9oQIgTS6Ux+yB+ljKWDMcbEFbEUJD63yiUw0W9R29RRKR630=\"},\"inclusionProof\":{\"logIndex\":\"18080984\",\"rootHash\":\"3QgSU4Sc5SaBpOIdtK7rq7YVvUIJa9ffmOBQJfAQ5No=\",\"treeSize\":\"18080985\",\"hashes\":[\"1VqcNP+E3GU18mbDgJETsYPoJoPiBbklVeJL1pT1cEU=\",\"TeoPJKP5nSkHigJeomgyX9aZZoddHPj9jYR2XBUXPmY=\",\"HYGE0qSPvaESM2IDQSij67KLAB+szi1KVxV/Rs/4oao=\",\"r5Dfj7qJpQin2WUzTTguka3V50Bo0mAIFHd3M/J1m/A=\",\"cj+mVHbPlEBj7SJvZUjTJ8GkBUjsTGRxO06+EhHpJI0=\",\"BjFsBrJyNhKTEH8w+f2KSzUI3erf7mABm3Xr99SHEn0=\",\"CrflNtVzHLcNx9sn8RoxU3TY97achLRHZbZywxnnJ8o=\",\"b3n5wXbbRN5E/WP1khHFeMJvwBNMYl7/pbbqIlmnA9k=\",\"pApK2lHZXMFTp32RUjqXhUaDn5VreViydgGWY2r35G8=\",\"7LYCkPo3kGZ6HBsTTt82Y2+LSJb6pYZspK4VhzDvQvA=\",\"rAAfgmPXo8TJp1LmkVDhAYrf0WzE4X4/mDuW1pwVM3Y=\",\"gf+9m552B3PnkWnO0o4KdVvjcT3WVHLrCbf1DoVYKFw=\"],\"checkpoint\":{\"envelope\":\"rekor.sigstore.dev - 1193050959916656506\\n18080985\\n3QgSU4Sc5SaBpOIdtK7rq7YVvUIJa9ffmOBQJfAQ5No=\\n\\n— rekor.sigstore.dev wNI9ajBGAiEAwmhqxQCnAv0coCsInw/SWm9h46zL6f0/o4tDrPu7uOICIQD/DsMW0cIMG0lNfqFtXBcl23j7YhsqIQudE5RSlyElRw==\\n\"}},\"canonicalizedBody\":\"eyJhcGlWZXJzaW9uIjoiMC4wLjIiLCJraW5kIjoiaW50b3RvIiwic3BlYyI6eyJjb250ZW50Ijp7ImVudmVsb3BlIjp7InBheWxvYWRUeXBlIjoiYXBwbGljYXRpb24vdm5kLmluLXRvdG8ranNvbiIsInNpZ25hdHVyZXMiOlt7ImtleWlkIjoiU0hBMjU2OmpsM2J3c3d1ODBQampva0NnaDBvMnc1YzJVNExoUUFFNTdnajljejFrekEiLCJwdWJsaWNLZXkiOiJMUzB0TFMxQ1JVZEpUaUJRVlVKTVNVTWdTMFZaTFMwdExTMEtUVVpyZDBWM1dVaExiMXBKZW1vd1EwRlJXVWxMYjFwSmVtb3dSRUZSWTBSUlowRkZNVTlzWWpONlRVRkdSbmhZUzBocFNXdFJUelZqU2pOWmFHdzFhVFpWVUhBclNXaDFkR1ZDU21KMVNHTkJOVlZ2WjB0dk1FVlhkR3hYZDFjMlMxTmhTMjlVVGtWWlREZEtiRU5SYVZadWEyaENhM1JWWjJjOVBRb3RMUzB0TFVWT1JDQlFWVUpNU1VNZ1MwVlpMUzB0TFMwPSIsInNpZyI6IlRVVlZRMGxHV0d0TE0xSlNjVzVqWW1FdmRVNW9iRmhEUzFaeVVIRjFjMnRCYjBSdU1YcERNamczSzBWdGNtRXlRV2xGUVc1Q05WWndaMHhDZVhNMFV6VnNWRUUyVm5od2RGaHZSbFpLU0drMlIwaENPVGRHUzI4MmFXWTJUVWs5In1dfSwiaGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjA2YWE0ZTYwMWYzMjc2ODMyODg0MjAzYTlhMmI3Nzg0NGQ0ZWUzZmRiMGY3NWE0NjA3ODQ5MzE0Y2I4N2QwYWEifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiI0MzMxZWIxMGI2ZjE4NDM3ZjZkYWM2OTdmN2Q3NWEyMGZjZjZlZWI5N2FmODRmMDAyZDIxYTkzYmUyOTk3YzdkIn19fX0=\"}],\"timestampVerificationData\":{\"rfc3161Timestamps\":[]}},\"dsseEnvelope\":{\"payload\":\"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjAuMSIsInN1YmplY3QiOlt7Im5hbWUiOiJwa2c6bnBtL3NpZ3N0b3JlQDMuMC4wIiwiZGlnZXN0Ijp7InNoYTUxMiI6IjNjNzMyMjdlMTg3NzEwZGUyNWEwYzcwNzBiM2VhNWRlZmZlNWJiMzgxM2RmMzZiZWY1ZmYyY2I5YjFhMDc4YzM2MzZjOThmMzFmODIyM2ZkOGExN2RjNmJlZWZhNDZhOGI4OTQ0ODk1NTc1MzFjNzA5MTEwMDBkODdmZTY2ZDc4In19XSwicHJlZGljYXRlVHlwZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9ucG0vYXR0ZXN0YXRpb24vdHJlZS9tYWluL3NwZWNzL3B1Ymxpc2gvdjAuMSIsInByZWRpY2F0ZSI6eyJuYW1lIjoic2lnc3RvcmUiLCJ2ZXJzaW9uIjoiMy4wLjAiLCJyZWdpc3RyeSI6Imh0dHBzOi8vcmVnaXN0cnkubnBtanMub3JnIn19\",\"payloadType\":\"application/vnd.in-toto+json\",\"signatures\":[{\"sig\":\"MEUCIFXkK3RRqncba/uNhlXCKVrPquskAoDn1zC287+Emra2AiEAnB5VpgLBys4S5lTA6VxptXoFVJHi6GHB97FKo6if6MI=\",\"keyid\":\"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA\"}]}},\"signedAccessSignatureUrl\":\"\"},{\"predicateType\":\"https://slsa.dev/provenance/v1\",\"bundle\":{\"mediaType\":\"application/vnd.dev.sigstore.bundle+json;version=0.2\",\"verificationMaterial\":{\"x509CertificateChain\":{\"certificates\":[{\"rawBytes\":\"MIIGtTCCBjugAwIBAgIUFZbCpi3CDAWvgrLHxtg1Y7uuzmUwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjQxMDE0MTYxMzQ1WhcNMjQxMDE0MTYyMzQ1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEf1geHKJmqtJp8PDuLWzA/2kUwTWxIQZuDpBv+oyuT7r/Ja7Ro8kGEQrJ/DBFSpT/npc35Pk3LmmRylyYoedRt6OCBVowggVWMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUmohazNhKN4gAImBmQV8TTMyBpeswHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wYwYDVR0RAQH/BFkwV4ZVaHR0cHM6Ly9naXRodWIuY29tL3NpZ3N0b3JlL3NpZ3N0b3JlLWpzLy5naXRodWIvd29ya2Zsb3dzL3JlbGVhc2UueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMBIGCisGAQQBg78wAQIEBHB1c2gwNgYKKwYBBAGDvzABAwQoM2E1N2E3NDFiZmI5ZjdjM2JjYTY5YjYzZTE3MGZjMjhlOTQzMmU2OTAVBgorBgEEAYO/MAEEBAdSZWxlYXNlMCIGCisGAQQBg78wAQUEFHNpZ3N0b3JlL3NpZ3N0b3JlLWpzMB0GCisGAQQBg78wAQYED3JlZnMvaGVhZHMvbWFpbjA7BgorBgEEAYO/MAEIBC0MK2h0dHBzOi8vdG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb20wZQYKKwYBBAGDvzABCQRXDFVodHRwczovL2dpdGh1Yi5jb20vc2lnc3RvcmUvc2lnc3RvcmUtanMvLmdpdGh1Yi93b3JrZmxvd3MvcmVsZWFzZS55bWxAcmVmcy9oZWFkcy9tYWluMDgGCisGAQQBg78wAQoEKgwoM2E1N2E3NDFiZmI5ZjdjM2JjYTY5YjYzZTE3MGZjMjhlOTQzMmU2OTAdBgorBgEEAYO/MAELBA8MDWdpdGh1Yi1ob3N0ZWQwNwYKKwYBBAGDvzABDAQpDCdodHRwczovL2dpdGh1Yi5jb20vc2lnc3RvcmUvc2lnc3RvcmUtanMwOAYKKwYBBAGDvzABDQQqDCgzYTU3YTc0MWJmYjlmN2MzYmNhNjliNjNlMTcwZmMyOGU5NDMyZTY5MB8GCisGAQQBg78wAQ4EEQwPcmVmcy9oZWFkcy9tYWluMBkGCisGAQQBg78wAQ8ECwwJNDk1NTc0NTU1MCsGCisGAQQBg78wARAEHQwbaHR0cHM6Ly9naXRodWIuY29tL3NpZ3N0b3JlMBgGCisGAQQBg78wAREECgwINzEwOTYzNTMwZQYKKwYBBAGDvzABEgRXDFVodHRwczovL2dpdGh1Yi5jb20vc2lnc3RvcmUvc2lnc3RvcmUtanMvLmdpdGh1Yi93b3JrZmxvd3MvcmVsZWFzZS55bWxAcmVmcy9oZWFkcy9tYWluMDgGCisGAQQBg78wARMEKgwoM2E1N2E3NDFiZmI5ZjdjM2JjYTY5YjYzZTE3MGZjMjhlOTQzMmU2OTAUBgorBgEEAYO/MAEUBAYMBHB1c2gwWwYKKwYBBAGDvzABFQRNDEtodHRwczovL2dpdGh1Yi5jb20vc2lnc3RvcmUvc2lnc3RvcmUtanMvYWN0aW9ucy9ydW5zLzExMzMxMjkwMzg3L2F0dGVtcHRzLzEwFgYKKwYBBAGDvzABFgQIDAZwdWJsaWMwgYkGCisGAQQB1nkCBAIEewR5AHcAdQDdPTBqxscRMmMZHhyZZzcCokpeuN48rf+HinKALynujgAAAZKLzphoAAAEAwBGMEQCIHQ9LL9LECgBdY6bClnXOGR7hznz7bzwEz0gPvFmanWuAiBeeN3h0wium7ANLgDTBsFqY/df2Op54BC9EAtias1ZJjAKBggqhkjOPQQDAwNoADBlAjEA2bLa8wNOQQ43ANDZOFJ85DDyn4DaFWQFjoWlQP3RFIYQ9WDD4a5km9mVxQ9og82+AjApsAV76yLFvmDXHiOHNptbeDageiM1/nWekZZJj1Cix43RclqCNu0Q4+fNKeqlrnU=\"}]},\"tlogEntries\":[{\"logIndex\":\"139985224\",\"logId\":{\"keyId\":\"wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=\"},\"kindVersion\":{\"kind\":\"intoto\",\"version\":\"0.0.2\"},\"integratedTime\":\"1728922425\",\"inclusionPromise\":{\"signedEntryTimestamp\":\"MEUCICdHXEjie6kN9q31KFPR+3uU0aoV7DrM3MQfhyU0USvSAiEAnu7lzyeQLrbqYXO7aXR2vxWctF1qYSR4y8ErAlDI59I=\"},\"inclusionProof\":{\"logIndex\":\"18080962\",\"rootHash\":\"fM8KxP/V5eJtk7Dsf1sQAGWiC/L3QYumuzrRdhTc6Qc=\",\"treeSize\":\"18080963\",\"hashes\":[\"Z5LqT/yzIYCvllsIhcpuwWgMS7NOP/fXUhZce4z17hE=\",\"HYGE0qSPvaESM2IDQSij67KLAB+szi1KVxV/Rs/4oao=\",\"r5Dfj7qJpQin2WUzTTguka3V50Bo0mAIFHd3M/J1m/A=\",\"cj+mVHbPlEBj7SJvZUjTJ8GkBUjsTGRxO06+EhHpJI0=\",\"BjFsBrJyNhKTEH8w+f2KSzUI3erf7mABm3Xr99SHEn0=\",\"CrflNtVzHLcNx9sn8RoxU3TY97achLRHZbZywxnnJ8o=\",\"b3n5wXbbRN5E/WP1khHFeMJvwBNMYl7/pbbqIlmnA9k=\",\"pApK2lHZXMFTp32RUjqXhUaDn5VreViydgGWY2r35G8=\",\"7LYCkPo3kGZ6HBsTTt82Y2+LSJb6pYZspK4VhzDvQvA=\",\"rAAfgmPXo8TJp1LmkVDhAYrf0WzE4X4/mDuW1pwVM3Y=\",\"gf+9m552B3PnkWnO0o4KdVvjcT3WVHLrCbf1DoVYKFw=\"],\"checkpoint\":{\"envelope\":\"rekor.sigstore.dev - 1193050959916656506\\n18080963\\nfM8KxP/V5eJtk7Dsf1sQAGWiC/L3QYumuzrRdhTc6Qc=\\n\\n— rekor.sigstore.dev wNI9ajBEAiBSSvf+ycholemEa7s9BZU1/y3ydkVbkeEESu61+iXtZQIgQmmlIGuzYrjIruUdMqYQCUzXOpQ34ldW2vD3gebXi40=\\n\"}},\"canonicalizedBody\":\"eyJhcGlWZXJzaW9uIjoiMC4wLjIiLCJraW5kIjoiaW50b3RvIiwic3BlYyI6eyJjb250ZW50Ijp7ImVudmVsb3BlIjp7InBheWxvYWRUeXBlIjoiYXBwbGljYXRpb24vdm5kLmluLXRvdG8ranNvbiIsInNpZ25hdHVyZXMiOlt7InB1YmxpY0tleSI6IkxTMHRMUzFDUlVkSlRpQkRSVkpVU1VaSlEwRlVSUzB0TFMwdENrMUpTVWQwVkVORFFtcDFaMEYzU1VKQlowbFZSbHBpUTNCcE0wTkVRVmQyWjNKTVNIaDBaekZaTjNWMWVtMVZkME5uV1VsTGIxcEplbW93UlVGM1RYY0tUbnBGVmsxQ1RVZEJNVlZGUTJoTlRXTXliRzVqTTFKMlkyMVZkVnBIVmpKTlVqUjNTRUZaUkZaUlVVUkZlRlo2WVZka2VtUkhPWGxhVXpGd1ltNVNiQXBqYlRGc1drZHNhR1JIVlhkSWFHTk9UV3BSZUUxRVJUQk5WRmw0VFhwUk1WZG9ZMDVOYWxGNFRVUkZNRTFVV1hsTmVsRXhWMnBCUVUxR2EzZEZkMWxJQ2t0dldrbDZhakJEUVZGWlNVdHZXa2w2YWpCRVFWRmpSRkZuUVVWbU1XZGxTRXRLYlhGMFNuQTRVRVIxVEZkNlFTOHlhMVYzVkZkNFNWRmFkVVJ3UW5ZS0syOTVkVlEzY2k5S1lUZFNiemhyUjBWUmNrb3ZSRUpHVTNCVUwyNXdZek0xVUdzelRHMXRVbmxzZVZsdlpXUlNkRFpQUTBKV2IzZG5aMVpYVFVFMFJ3cEJNVlZrUkhkRlFpOTNVVVZCZDBsSVowUkJWRUpuVGxaSVUxVkZSRVJCUzBKblozSkNaMFZHUWxGalJFRjZRV1JDWjA1V1NGRTBSVVpuVVZWdGIyaGhDbnBPYUV0T05HZEJTVzFDYlZGV09GUlVUWGxDY0dWemQwaDNXVVJXVWpCcVFrSm5kMFp2UVZVek9WQndlakZaYTBWYVlqVnhUbXB3UzBaWGFYaHBORmtLV2tRNGQxbDNXVVJXVWpCU1FWRklMMEpHYTNkV05GcFdZVWhTTUdOSVRUWk1lVGx1WVZoU2IyUlhTWFZaTWpsMFRETk9jRm96VGpCaU0wcHNURE5PY0FwYU0wNHdZak5LYkV4WGNIcE1lVFZ1WVZoU2IyUlhTWFprTWpsNVlUSmFjMkl6WkhwTU0wcHNZa2RXYUdNeVZYVmxWekZ6VVVoS2JGcHVUWFpoUjFab0NscElUWFppVjBad1ltcEJOVUpuYjNKQ1owVkZRVmxQTDAxQlJVSkNRM1J2WkVoU2QyTjZiM1pNTTFKMllUSldkVXh0Um1wa1IyeDJZbTVOZFZveWJEQUtZVWhXYVdSWVRteGpiVTUyWW01U2JHSnVVWFZaTWpsMFRVSkpSME5wYzBkQlVWRkNaemM0ZDBGUlNVVkNTRUl4WXpKbmQwNW5XVXRMZDFsQ1FrRkhSQXAyZWtGQ1FYZFJiMDB5UlRGT01rVXpUa1JHYVZwdFNUVmFhbVJxVFRKS2FsbFVXVFZaYWxsNldsUkZNMDFIV21wTmFtaHNUMVJSZWsxdFZUSlBWRUZXQ2tKbmIzSkNaMFZGUVZsUEwwMUJSVVZDUVdSVFdsZDRiRmxZVG14TlEwbEhRMmx6UjBGUlVVSm5OemgzUVZGVlJVWklUbkJhTTA0d1lqTktiRXd6VG5BS1dqTk9NR0l6U214TVYzQjZUVUl3UjBOcGMwZEJVVkZDWnpjNGQwRlJXVVZFTTBwc1dtNU5kbUZIVm1oYVNFMTJZbGRHY0dKcVFUZENaMjl5UW1kRlJRcEJXVTh2VFVGRlNVSkRNRTFMTW1nd1pFaENlazlwT0haa1J6bHlXbGMwZFZsWFRqQmhWemwxWTNrMWJtRllVbTlrVjBveFl6SldlVmt5T1hWa1IxWjFDbVJETldwaU1qQjNXbEZaUzB0M1dVSkNRVWRFZG5wQlFrTlJVbGhFUmxadlpFaFNkMk42YjNaTU1tUndaRWRvTVZscE5XcGlNakIyWXpKc2JtTXpVbllLWTIxVmRtTXliRzVqTTFKMlkyMVZkR0Z1VFhaTWJXUndaRWRvTVZscE9UTmlNMHB5V20xNGRtUXpUWFpqYlZaeldsZEdlbHBUTlRWaVYzaEJZMjFXYlFwamVUbHZXbGRHYTJONU9YUlpWMngxVFVSblIwTnBjMGRCVVZGQ1p6YzRkMEZSYjBWTFozZHZUVEpGTVU0eVJUTk9SRVpwV20xSk5WcHFaR3BOTWtwcUNsbFVXVFZaYWxsNldsUkZNMDFIV21wTmFtaHNUMVJSZWsxdFZUSlBWRUZrUW1kdmNrSm5SVVZCV1U4dlRVRkZURUpCT0UxRVYyUndaRWRvTVZscE1XOEtZak5PTUZwWFVYZE9kMWxMUzNkWlFrSkJSMFIyZWtGQ1JFRlJjRVJEWkc5a1NGSjNZM3B2ZGt3eVpIQmtSMmd4V1drMWFtSXlNSFpqTW14dVl6TlNkZ3BqYlZWMll6SnNibU16VW5aamJWVjBZVzVOZDA5QldVdExkMWxDUWtGSFJIWjZRVUpFVVZGeFJFTm5lbGxVVlROWlZHTXdUVmRLYlZscWJHMU9NazE2Q2xsdFRtaE9hbXhwVG1wT2JFMVVZM2RhYlUxNVQwZFZOVTVFVFhsYVZGazFUVUk0UjBOcGMwZEJVVkZDWnpjNGQwRlJORVZGVVhkUVkyMVdiV041T1c4S1dsZEdhMk41T1hSWlYyeDFUVUpyUjBOcGMwZEJVVkZDWnpjNGQwRlJPRVZEZDNkS1RrUnJNVTVVWXpCT1ZGVXhUVU56UjBOcGMwZEJVVkZDWnpjNGR3cEJVa0ZGU0ZGM1ltRklVakJqU0UwMlRIazVibUZZVW05a1YwbDFXVEk1ZEV3elRuQmFNMDR3WWpOS2JFMUNaMGREYVhOSFFWRlJRbWMzT0hkQlVrVkZDa05uZDBsT2VrVjNUMVJaZWs1VVRYZGFVVmxMUzNkWlFrSkJSMFIyZWtGQ1JXZFNXRVJHVm05a1NGSjNZM3B2ZGt3eVpIQmtSMmd4V1drMWFtSXlNSFlLWXpKc2JtTXpVblpqYlZWMll6SnNibU16VW5aamJWVjBZVzVOZGt4dFpIQmtSMmd4V1drNU0ySXpTbkphYlhoMlpETk5kbU50Vm5OYVYwWjZXbE0xTlFwaVYzaEJZMjFXYldONU9XOWFWMFpyWTNrNWRGbFhiSFZOUkdkSFEybHpSMEZSVVVKbk56aDNRVkpOUlV0bmQyOU5Na1V4VGpKRk0wNUVSbWxhYlVrMUNscHFaR3BOTWtwcVdWUlpOVmxxV1hwYVZFVXpUVWRhYWsxcWFHeFBWRkY2VFcxVk1rOVVRVlZDWjI5eVFtZEZSVUZaVHk5TlFVVlZRa0ZaVFVKSVFqRUtZekpuZDFkM1dVdExkMWxDUWtGSFJIWjZRVUpHVVZKT1JFVjBiMlJJVW5kamVtOTJUREprY0dSSGFERlphVFZxWWpJd2RtTXliRzVqTTFKMlkyMVZkZ3BqTW14dVl6TlNkbU50VlhSaGJrMTJXVmRPTUdGWE9YVmplVGw1WkZjMWVreDZSWGhOZWsxNFRXcHJkMDE2WnpOTU1rWXdaRWRXZEdOSVVucE1la1YzQ2tabldVdExkMWxDUWtGSFJIWjZRVUpHWjFGSlJFRmFkMlJYU25OaFYwMTNaMWxyUjBOcGMwZEJVVkZDTVc1clEwSkJTVVZsZDFJMVFVaGpRV1JSUkdRS1VGUkNjWGh6WTFKTmJVMWFTR2g1V2xwNlkwTnZhM0JsZFU0ME9ISm1LMGhwYmt0QlRIbHVkV3BuUVVGQldrdE1lbkJvYjBGQlFVVkJkMEpIVFVWUlF3cEpTRkU1VEV3NVRFVkRaMEprV1RaaVEyeHVXRTlIVWpkb2VtNTZOMko2ZDBWNk1HZFFka1p0WVc1WGRVRnBRbVZsVGpOb01IZHBkVzAzUVU1TVowUlVDa0p6Um5GWkwyUm1Nazl3TlRSQ1F6bEZRWFJwWVhNeFdrcHFRVXRDWjJkeGFHdHFUMUJSVVVSQmQwNXZRVVJDYkVGcVJVRXlZa3hoT0hkT1QxRlJORE1LUVU1RVdrOUdTamcxUkVSNWJqUkVZVVpYVVVacWIxZHNVVkF6VWtaSldWRTVWMFJFTkdFMWEyMDViVlo0VVRsdlp6Z3lLMEZxUVhCelFWWTNObmxNUmdwMmJVUllTR2xQU0U1d2RHSmxSR0ZuWldsTk1TOXVWMlZyV2xwS2FqRkRhWGcwTTFKamJIRkRUblV3VVRRclprNUxaWEZzY201VlBRb3RMUzB0TFVWT1JDQkRSVkpVU1VaSlEwRlVSUzB0TFMwdCIsInNpZyI6IlRVVlJRMGxJUzJkTkszUTViMmhUY1RSMkt6RjBlVXRVYmpCTFRrNUhkVXhYUVVrNWFFMDJORXRsWkdVd1EyeHRRV2xDYlZRelJtUkxWMEY2WkRaNWIweENkVFEwVldrNVdrMWxPRnBGWW5NeU9IZEVWMVZ1V0cxbVVXVnlaejA5In1dfSwiaGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjgxMWU2OGM0YjNlYjFmYjRiZjc4Y2ZhMWEzYTUxYzFjMjE4MmM0ZWMxZTU0M2VlZDdmODM2YzMwMTk4ODMwMmMifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJhMTU0MDliZjRhYTIwYjdlOTNlM2FhZmJlMzllMTE3MDVlZTAyYzIxM2Q3N2M5YzQ1YzE3Y2JlZDM5YzMyMzhhIn19fX0=\"}],\"timestampVerificationData\":{\"rfc3161Timestamps\":[]}},\"dsseEnvelope\":{\"payload\":\"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoicGtnOm5wbS9zaWdzdG9yZUAzLjAuMCIsImRpZ2VzdCI6eyJzaGE1MTIiOiIzYzczMjI3ZTE4NzcxMGRlMjVhMGM3MDcwYjNlYTVkZWZmZTViYjM4MTNkZjM2YmVmNWZmMmNiOWIxYTA3OGMzNjM2Yzk4ZjMxZjgyMjNmZDhhMTdkYzZiZWVmYTQ2YThiODk0NDg5NTU3NTMxYzcwOTExMDAwZDg3ZmU2NmQ3OCJ9fV0sInByZWRpY2F0ZVR5cGUiOiJodHRwczovL3Nsc2EuZGV2L3Byb3ZlbmFuY2UvdjEiLCJwcmVkaWNhdGUiOnsiYnVpbGREZWZpbml0aW9uIjp7ImJ1aWxkVHlwZSI6Imh0dHBzOi8vc2xzYS1mcmFtZXdvcmsuZ2l0aHViLmlvL2dpdGh1Yi1hY3Rpb25zLWJ1aWxkdHlwZXMvd29ya2Zsb3cvdjEiLCJleHRlcm5hbFBhcmFtZXRlcnMiOnsid29ya2Zsb3ciOnsicmVmIjoicmVmcy9oZWFkcy9tYWluIiwicmVwb3NpdG9yeSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9zaWdzdG9yZS9zaWdzdG9yZS1qcyIsInBhdGgiOiIuZ2l0aHViL3dvcmtmbG93cy9yZWxlYXNlLnltbCJ9fSwiaW50ZXJuYWxQYXJhbWV0ZXJzIjp7ImdpdGh1YiI6eyJldmVudF9uYW1lIjoicHVzaCIsInJlcG9zaXRvcnlfaWQiOiI0OTU1NzQ1NTUiLCJyZXBvc2l0b3J5X293bmVyX2lkIjoiNzEwOTYzNTMifX0sInJlc29sdmVkRGVwZW5kZW5jaWVzIjpbeyJ1cmkiOiJnaXQraHR0cHM6Ly9naXRodWIuY29tL3NpZ3N0b3JlL3NpZ3N0b3JlLWpzQHJlZnMvaGVhZHMvbWFpbiIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiIzYTU3YTc0MWJmYjlmN2MzYmNhNjliNjNlMTcwZmMyOGU5NDMyZTY5In19XX0sInJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY3Rpb25zL3J1bm5lci9naXRodWItaG9zdGVkIn0sIm1ldGFkYXRhIjp7Imludm9jYXRpb25JZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9zaWdzdG9yZS9zaWdzdG9yZS1qcy9hY3Rpb25zL3J1bnMvMTEzMzEyOTAzODcvYXR0ZW1wdHMvMSJ9fX19\",\"payloadType\":\"application/vnd.in-toto+json\",\"signatures\":[{\"sig\":\"MEQCIHKgM+t9ohSq4v+1tyKTn0KNNGuLWAI9hM64Kede0ClmAiBmT3FdKWAzd6yoLBu44Ui9ZMe8ZEbs28wDWUnXmfQerg==\",\"keyid\":\"\"}]}},\"signedAccessSignatureUrl\":\"\"}]}", "packageMetadata": "{\n \"name\": \"sigstore\",\n \"version\": \"3.0.0\",\n \"repository\": {\n \"url\": \"git+https://github.com/sigstore/sigstore-js.git\",\n \"type\": \"git\"\n },\n \"gitHead\": \"3a57a741bfb9f7c3bca69b63e170fc28e9432e69\",\n \"dist\": {\n \"integrity\": \"sha512-PHMifhh3EN4loMcHCz6l3v/luzgT3za+9f8subGgeMNjbJjzH4Ij/YoX3Gvu+kaouJRIlVdTHHCREADYf+ZteA==\",\n \"tarball\": \"https://registry.npmjs.org/sigstore/-/sigstore-3.0.0.tgz\",\n \"attestations\": {\n \"url\": \"https://registry.npmjs.org/-/npm/v1/attestations/sigstore@3.0.0\",\n \"provenance\": {\n \"predicateType\": \"https://slsa.dev/provenance/v1\"\n }\n }\n }\n}" } } } } } }, "responses": { "200": { "description": "Calculation result envelope.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArtifactProvenanceExplorerResult" } } } }, "400": { "description": "Malformed JSON body.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "422": { "description": "Invalid input (see errors[]).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "429": { "description": "Rate limit exceeded (see Retry-After).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } } } } }, "/api/v1/tool": { "get": { "operationId": "getToolDefinition", "summary": "Inputs, output schema and examples for this tool", "responses": { "200": { "description": "Tool definition.", "content": { "application/json": { "schema": { "type": "object" } } } } } } } }, "components": { "schemas": { "Problem": { "type": "object", "description": "RFC 9457 problem details. 422 responses include per-field `errors`.", "required": [ "type", "title", "status", "detail" ], "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer" }, "detail": { "type": "string" }, "code": { "type": "string" }, "errors": { "type": "array", "items": { "type": "object", "required": [ "field", "message" ], "properties": { "field": { "type": "string" }, "message": { "type": "string" } } } } } }, "ArtifactProvenanceExplorerInput": { "type": "object", "additionalProperties": false, "properties": { "package": { "title": "npm package@version", "description": "Looks up registry.npmjs.org attestations and metadata. Leave empty when pasting.", "type": "string", "maxLength": 260 }, "attestations": { "title": "Or paste attestations JSON", "description": "The response of /-/npm/v1/attestations/@, or a single Sigstore bundle.", "type": "string", "maxLength": 2000000 }, "attestationsFile": { "title": "Or upload attestations / bundle (.json)", "type": "object", "description": "Upload as {filename, contentType?, contentBase64}. Max 1953 KiB. Accepts .json,.sigstore,application/json.", "additionalProperties": false, "required": [ "filename", "contentBase64" ], "properties": { "filename": { "type": "string" }, "contentType": { "type": "string" }, "contentBase64": { "type": "string" } } }, "packageMetadata": { "title": "Optional: package version metadata JSON", "description": "registry.npmjs.org// document, used for the repository / gitHead / integrity cross-checks in paste mode.", "type": "string", "maxLength": 500000 } }, "required": [] }, "ArtifactProvenanceExplorerResult": { "type": "object", "additionalProperties": false, "required": [ "schemaVersion", "tool", "computedAt", "inputs", "summary", "result", "units", "assumptions", "sources", "warnings", "presentation", "links" ], "properties": { "schemaVersion": { "type": "string", "const": "1.0" }, "tool": { "type": "object", "additionalProperties": false, "required": [ "id", "name", "version" ], "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "version": { "type": "string" } } }, "computedAt": { "type": "string", "format": "date-time" }, "inputs": { "type": "object", "description": "Normalised inputs actually used, including applied defaults." }, "summary": { "type": "string" }, "result": { "type": "object", "additionalProperties": false, "required": [ "package", "version", "attestationCount", "verdict", "provenance", "publishAttestation", "signingIdentity", "attestationChecks", "crossChecks", "notVerified" ], "properties": { "package": { "type": [ "string", "null" ] }, "version": { "type": [ "string", "null" ] }, "attestationCount": { "type": "integer" }, "verdict": { "type": "string", "enum": [ "verified", "verified-with-mismatches", "signature-problems", "no-attestations" ] }, "provenance": { "type": [ "object", "null" ], "additionalProperties": false, "required": [ "predicateType", "buildType", "builderId", "sourceRepo", "commit", "ref", "workflowPath", "eventName", "invocationId" ], "properties": { "predicateType": { "type": "string" }, "buildType": { "type": [ "string", "null" ] }, "builderId": { "type": [ "string", "null" ] }, "sourceRepo": { "type": [ "string", "null" ] }, "commit": { "type": [ "string", "null" ] }, "ref": { "type": [ "string", "null" ] }, "workflowPath": { "type": [ "string", "null" ] }, "eventName": { "type": [ "string", "null" ] }, "invocationId": { "type": [ "string", "null" ] } } }, "publishAttestation": { "type": [ "object", "null" ], "additionalProperties": false, "required": [ "registry", "signedBy" ], "properties": { "registry": { "type": [ "string", "null" ] }, "signedBy": { "type": [ "string", "null" ] } } }, "signingIdentity": { "type": [ "object", "null" ], "additionalProperties": false, "required": [ "subjectAltName", "issuer", "oidcIssuer", "runnerEnvironment", "loggedAt" ], "properties": { "subjectAltName": { "type": [ "string", "null" ] }, "issuer": { "type": "string" }, "oidcIssuer": { "type": [ "string", "null" ] }, "runnerEnvironment": { "type": [ "string", "null" ] }, "loggedAt": { "type": [ "string", "null" ] } } }, "attestationChecks": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "attestation", "checks" ], "properties": { "attestation": { "type": "string" }, "checks": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "check", "status", "detail" ], "properties": { "check": { "type": "string" }, "status": { "type": "string", "enum": [ "pass", "fail", "skipped" ] }, "detail": { "type": "string" } } } } } } }, "crossChecks": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "check", "status", "detail" ], "properties": { "check": { "type": "string" }, "status": { "type": "string", "enum": [ "pass", "fail", "skipped" ] }, "detail": { "type": "string" } } } }, "notVerified": { "type": "array", "items": { "type": "string" } } } }, "units": { "type": "object", "additionalProperties": { "type": "string" } }, "assumptions": { "type": "array", "items": { "type": "string" } }, "sources": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "title" ], "properties": { "title": { "type": "string" }, "url": { "type": "string" }, "publisher": { "type": "string" }, "retrievedAt": { "type": "string" }, "note": { "type": "string" } } } }, "warnings": { "type": "array", "items": { "type": "string" } }, "presentation": { "type": "array", "items": { "type": "object" }, "description": "Display blocks used by the human page (same data)." }, "links": { "type": "object", "additionalProperties": false, "required": [ "human", "api", "openapi", "methodology" ], "properties": { "human": { "type": "string", "format": "uri" }, "api": { "type": "string", "format": "uri" }, "openapi": { "type": "string", "format": "uri" }, "methodology": { "type": "string", "format": "uri" } } } } } } } }