Verify the build provenance

Assured OSS packages are built with SLSA Level 2 compliance. Build provenance is provided as part of the security metadata. This page explains how to verify the build provenance metadata.

This document applies to the free tier. For information about the build provenance in the premium tier, see Access security metadata and verify packages.

Before you begin

  • Install cosign to verify the signature in the build provenance.

Set up authentication

For information about setting up authentication, see Set up authentication.

Verify build provenance

Build provenance is signed using an in-toto attestation which in turn uses dsse envelope format. This means that the generated signature contains the wrapped signature and the raw data.

Using the aoss-verifier tool

  1. To verify build provenance, install the aoss-verifier tool.

  2. Export $(go env GOPATH)/bin, and run the aoss-verifier verify-package command with the --verify_build_provenance flag.

    aoss-verifier verify-package \
   --language LANGUAGE \
   --package_id PACKAGE_ID \
   --version VERSION \
   --artifact_path ARTIFACT_PATH \
   --verify_build_provenance \
   [--disable_certificate_verification] \
   [--temp_downloads_path TEMP_DOWNLOADS_DIR_PATH] \
   [--disable_deletes]

    Replace the following:

    • LANGUAGE: The package language. The value must be in lowercase.
    • PACKAGE_ID: For Java, the format is groupId:artifactId. For Python, the format is packageName. The value must be in lowercase.
    • VERSION: The version of the package.
    • ARTIFACT_PATH: The path to the data file in your local directory that you want to verify. Use the following filename extensions:
      • jar file extension for a Java package
      • whl file extension for a Python package

    --disable_certificate_verification is an optional flag which skips matching leaf certificate to the root certificate through the certificate chain, if used.

    --temp_downloads_path is an optional flag to set the path where you want to download the files. Replace TEMP_DOWNLOADS_DIR_PATH. If this flag isn't set, the files are downloaded to the tmp_downloads folder in the current directory.