Remediation Standards
Active Evaluation FINOS Labs This material is provisional and has not been published as a formal FINOS standard.
Home / Standards / REL-007
REL-007

Build Provenance and Signed Attestation

Producers should sign an attestation linking the published artifact digest to the source tag, build process, SBOM, VEX, test evidence, and license audit.

Status
Pre-Draft
Version
0.0.1
Pack
OSERA-SP-0.2.0 observe
Ratified
Not ratified
Fitness
Observe-only check
Category
Release Process
Applies to
Patch providers, Repository operators, Enterprise recipients
Machine-readable
YAML / JSON

Structured Requirements

REL-007.REQ-001 SHOULD partially-automated

Producers should sign an attestation linking the artifact digest to the source tag and build provenance.

Check Severity Evidence
REL-007.CHECK-001
Signed build provenance attestation is present 		observe artifact_digest, source_tag, attestation_signature
REL-007.REQ-002 SHOULD manual

The attestation should reference SBOM, VEX, test evidence, and license audit material for the release.

Check Severity Evidence
REL-007.CHECK-002
Attestation references release evidence bundle 		observe sbom, vex, test_evidence, license_audit

Requirement

Producers SHOULD sign an attestation linking the published artifact digest to the source tag and build provenance.

The attestation SHOULD reference release evidence such as SBOM, VEX, test evidence, and license audit material.

Rationale

SP-0.1.0 can validate source provenance, release metadata, bytecode compatibility, feed entries, producer approval, and package hygiene. It does not yet prove that a specific binary was built from a specific source tag.

Reproducible builds remain an important OSERA goal. The standards group is deferring the precise proof format, build environment expectations, and source-to-binary attestation requirements because arbitrary legacy repositories use different build systems, runtimes, plugins, and publication flows.

Build provenance and signed release evidence should be the first observe-mode path toward SP-0.2.0.

Observe-mode evidence

Observe-mode evidence SHOULD include:

  • artifact digest;
  • source repository and tag;
  • producer identity;
  • signed attestation;
  • build system reference;
  • SBOM and VEX references;
  • test evidence;
  • license audit reference.