Publishing Attestations
You can publish attestations for a software package by calling the Develocity Provenance Governor API directly, or by using the Develocity Provenance Governor GitHub Action.
In both cases, the following information will be needed:
| Information | Where to Find It | Example |
|---|---|---|
Package type |
Your build system or registry type |
|
Package name |
Artifact name from your build |
|
Package version |
Build version or tag |
|
SHA-256 digest |
Build output or registry metadata |
|
Repository URL |
Artifactory repository where package is stored |
|
Build Scan IDs or Query |
Develocity Build Scan URLs or advanced search |
|
When to Publish Attestations
You can publish attestations for a software package at any time after the package has been built and published to Artifactory.
This flexibility allows you to optimize your workflow:
-
Immediate publishing: Publish right after the build for complete tracking
-
Gated publishing: Only publish for packages that pass quality gates
-
Batch publishing: Collect multiple builds and publish together
Delaying attestations until it is known the package will move forward reduces the number of attestations to store and manage. E.g., only publish for packages passing an initial quality gate.
For details on using the API, see API Reference. For GitHub Actions, see GitHub Actions.
Attestation Types
Develocity Provenance Governor generates attestations compliant with the in-toto Attestations Framework. Each attestation is a JSON document wrapped in a signing envelope and has a subject and predicate describing the type and properties.
|
See Attestations for a detailed description of all attestation types published. |
The following attestation types are supported:
| Attestation | Predicate Type | Description |
|---|---|---|
Attests to the build tool used to create the package, including version. |
||
Attests to the Java toolchains used during the build. |
||
|
Attests to repository sources for resolved dependencies. |
|
Attests to dependencies resolved during the build. |
||
Attests to the repositories where the package was published. |
||
Records that an artifact has been verified against a set of policies. |
||
Provides enriched dependency analysis data. |