schema-version: 0.1.0
standard:
  schema-version: 0.1.0
  sequence: 270
  standard_id: REL-007
  title: Build Provenance and Signed Attestation
  summary: Producers should sign an attestation linking the published artifact digest
    to the source tag, build process, SBOM, VEX, test evidence, and license audit.
  doc-status: Pre-Draft
  standard-version: 0.0.1
  candidate-pack: OSERA-SP-0.2.0 observe
  ratified-in: Not ratified
  ratified-date: Not ratified
  fitness-role: Observe-only check
  type: REL
  category: Release Process
  applies-to:
  - Patch providers
  - Repository operators
  - Enterprise recipients
  requirements:
  - id: REL-007.REQ-001
    level: SHOULD
    text: Producers should sign an attestation linking the artifact digest to the
      source tag and build provenance.
    checkability: partially-automated
    checks:
    - id: REL-007.CHECK-001
      title: Signed build provenance attestation is present
      type: release-evidence
      severity: observe
      implementation: osera-fitness.rel007.signed_build_attestation
      evidence:
      - artifact_digest
      - source_tag
      - attestation_signature
  - id: REL-007.REQ-002
    level: SHOULD
    text: The attestation should reference SBOM, VEX, test evidence, and license audit
      material for the release.
    checkability: manual
    checks:
    - id: REL-007.CHECK-002
      title: Attestation references release evidence bundle
      type: release-evidence
      severity: observe
      implementation: osera-fitness.rel007.evidence_bundle_references
      evidence:
      - sbom
      - vex
      - test_evidence
      - license_audit
  source_path: docs/_standards/rel-007-build-provenance-and-signed-attestation.md
  url: "/standards/rel-007-build-provenance-and-signed-attestation/"