Attestations

When you publish attestations, Develocity Provenance Governor stores them in Artifactory’s evidence store. All attestations are in-toto attestations.

The following predicate types are published, when the source Build Scan contains the relevant data:

Attestation Predicate Type Description

Build Tool

https://gradle.com/attestation/build-tool/v1

Attests to the build tool used to create the package, including version.

Java Toolchains

https://gradle.com/attestation/java-toolchains/v1

Attests to the Java toolchains used during the build.

Resolved Dependencies Repositories

https://gradle.com/attestation/resolved-dependencies-repositories/v1

Attests to repository sources for resolved dependencies.

Resolved Dependencies

https://gradle.com/attestation/resolved-dependencies/v1

Attests to dependencies resolved during the build.

Publish Repositories

https://gradle.com/attestation/publish-repositories/v1

Attests to the repositories where the package was published.

Verification Summary

https://slsa.dev/verification_summary/v1

Records that an artifact has been verified against a set of policies.

Dependency Insights

https://policies.gradle.com/dependency-insights/v1

Provides enriched dependency analysis data.

Each sub-page describes the predicate payload (the JSON object found in the predicate field of an in-toto Statement whose predicateType matches the given URI). The examples show only the predicate object (not the full in-toto Statement wrapper) for brevity.