{ "annotations": [ { "annotator": { "component": { "externalReferences": [ { "type": "vcs", "url": "https://github.com/plimsollmark/plimsoll" } ], "name": "plimsoll-sbom", "type": "application", "version": "0.2.0" } }, "bom-ref": "limits", "subjects": [ "program" ], "text": "The attached run record is signed; this BOM is unsigned. Agent authorship is supplied example context, not a record fact, and the execution layer cannot identify the model. Network isolation is provider configuration, not a separately signed runtime measurement; a granted run reaches only the routes its grant lists, and what reached the other side is not in this record. The run's times are the daemon's own unwitnessed clock. An attached key alone establishes consistency, not signer identity; use an independently trusted key. Display names and the assessor label are unsigned presentation. The attached bundle line proves itself; the whole bundle it belongs to is referenced by digest and checked when supplied. This is run evidence, not an inventory of the image's installed packages.", "timestamp": "2026-10-23T20:11:18.168Z" } ], "bomFormat": "CycloneDX", "components": [ { "bom-ref": "image", "externalReferences": [ { "hashes": [ { "alg": "SHA-256", "content": "7e0b9a40e742f401e3a006a7362ebba1c5f3ac832107858dcf104d8f2b6de603" } ], "type": "bom", "url": "https://plimsollmark.github.io/plimsoll/examples/sbom/image-a6ef2ea1c8f1.cdx.json" }, { "type": "bom", "url": "urn:cdx:f9bc9442-7192-4f59-9f06-38f71e427479/1#d13ed0dc05c4b68b" } ], "hashes": [ { "alg": "SHA-256", "content": "a6ef2ea1c8f1de5c885e1a18ba7ee4d962e3a859877f6f46c2fb7ebac1f6cc5c" } ], "name": "sandbox", "properties": [ { "name": "plimsoll:environment", "value": "docker-image:sha256:32da77b1be24de4c152667c28ab63531425cd69000acf30a328985cb857377f7" }, { "name": "plimsoll:software_identity", "value": "oci-manifest:linux/amd64@sha256:a6ef2ea1c8f1de5c885e1a18ba7ee4d962e3a859877f6f46c2fb7ebac1f6cc5c" } ], "purl": "pkg:oci/sandbox@sha256:a6ef2ea1c8f1de5c885e1a18ba7ee4d962e3a859877f6f46c2fb7ebac1f6cc5c", "type": "container", "version": "sha256:a6ef2ea1c8f1de5c885e1a18ba7ee4d962e3a859877f6f46c2fb7ebac1f6cc5c" } ], "declarations": { "affirmation": { "statement": "The attached run record was stated by plimsolld, checked and signed by plimsoll-attest, and restated here; plimsoll-attest verify and this program's -check recompute it. This affirmation and BOM are unsigned." }, "assessors": [ { "bom-ref": "assessor", "organization": { "name": "plimsoll examples (self-assessed)" }, "thirdParty": false } ], "attestations": [ { "assessor": "assessor", "map": [ { "claims": [ "claim-code" ], "confidence": { "rationale": "a signature check and a digest recomputation, not a judgement or a probability that the runtime assertion is true", "score": 1 }, "conformance": { "rationale": "The claim matches the signed exchange under a deterministic comparison; this is self-assessed consistency, not independent runtime assurance.", "score": 1 }, "requirement": "req-code" }, { "claims": [ "claim-image" ], "confidence": { "rationale": "a signature check and a digest recomputation, not a judgement or a probability that the runtime assertion is true", "score": 1 }, "conformance": { "rationale": "The claim matches the signed exchange under a deterministic comparison; this is self-assessed consistency, not independent runtime assurance.", "score": 1 }, "requirement": "req-image" }, { "claims": [ "claim-tier" ], "confidence": { "rationale": "a signature check and a digest recomputation, not a judgement or a probability that the runtime assertion is true", "score": 1 }, "conformance": { "rationale": "The claim matches the signed exchange under a deterministic comparison; this is self-assessed consistency, not independent runtime assurance.", "score": 1 }, "requirement": "req-tier" } ], "summary": "A self-assessed restatement of a signed run record with reproducible consistency checks." } ], "claims": [ { "bom-ref": "claim-code", "evidence": [ "evidence-run-record" ], "predicate": "The program's 4 files, file-set digest d0f73fac975a601a647e768eaba084b72ff80a6b7dca4c3f1b62eec16b244c43, are the files in the stored request whose signed digest b5386b8a32215a20f843fddccc796543ab45ff0bf7fa63d38ca87855d201a7e1 covers them with the isolation floor and timeout.", "reasoning": "Each claim restates the run record the daemon stated and the attest harness checked against the stored request and result and signed. The attached bundle line permits those checks to be repeated. This emitter did not observe execution. The tier is configuration and provider evidence plus startup smoke tests, never runtime attestation.", "target": "program" }, { "bom-ref": "claim-image", "evidence": [ "evidence-run-record" ], "predicate": "The daemon states that the run executed in the image whose OCI manifest digest is sha256:a6ef2ea1c8f1de5c885e1a18ba7ee4d962e3a859877f6f46c2fb7ebac1f6cc5c (environment docker-image:sha256:32da77b1be24de4c152667c28ab63531425cd69000acf30a328985cb857377f7), verified before launch.", "reasoning": "Each claim restates the run record the daemon stated and the attest harness checked against the stored request and result and signed. The attached bundle line permits those checks to be repeated. This emitter did not observe execution. The tier is configuration and provider evidence plus startup smoke tests, never runtime attestation.", "target": "program" }, { "bom-ref": "claim-tier", "evidence": [ "evidence-run-record" ], "predicate": "The daemon states provider docker and isolation tier kernel, at or above requested floor kernel, from 2026-10-23T20:11:12.005Z to 2026-10-23T20:11:18.168Z UTC; the stored request names no host-API grant and the result digest is 960733790831a2bc56def99ba8f069c2921817a8aae9303c62a4f2c87ccc977d. The provider's no-grant configuration supplies network isolation; this record is not a network measurement.", "reasoning": "Each claim restates the run record the daemon stated and the attest harness checked against the stored request and result and signed. The attached bundle line permits those checks to be repeated. This emitter did not observe execution. The tier is configuration and provider evidence plus startup smoke tests, never runtime attestation.", "target": "program" } ], "evidence": [ { "author": { "name": "plimsoll-attest key 88d311fb942e0fd87cdb1214b385db5fc354c166e84763f6d37885dbc96df379" }, "bom-ref": "evidence-run-record", "created": "2026-10-23T20:11:18.168Z", "data": [ { "contents": { "attachment": { "content": "eyJwYXlsb2FkVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5pbi10b3RvK2pzb24iLCJwYXlsb2FkIjoiZXlKZmRIbHdaU0k2SW1oMGRIQnpPaTh2YVc0dGRHOTBieTVwYnk5VGRHRjBaVzFsYm5RdmRqRWlMQ0p6ZFdKcVpXTjBJanBiZXlKdVlXMWxJam9pY25WdUxYSmxZMjl5WkNJc0ltUnBaMlZ6ZENJNmV5SnphR0V5TlRZaU9pSXlPV015WlRkaU1EYzBNamxtTWpWaVltVmtaR0UwWmpRMU56SmlORGN5TURnek56UXpOMkppWmpGbU5tVTVNalJoTnpWa04yUTBORGN6T1RVd09XUTJJbjE5WFN3aWNISmxaR2xqWVhSbFZIbHdaU0k2SW1oMGRIQnpPaTh2Y0d4cGJYTnZiR3h0WVhKckxtZHBkR2gxWWk1cGJ5OXdiR2x0YzI5c2JDOXlkVzR0Y21WamIzSmtMM1l4SWl3aWNISmxaR2xqWVhSbElqcDdJblpsY25OcGIyNGlPalFzSW5KbGNYVmxjM1JmYzJoaE1qVTJJam9pWWpVek9EWmlPR0V6TWpJeE5XRXlNR1k0TkRObVpHUmpZMk0zT1RZMU5ETmhZalExWm1Zd1ltWTNabUUyTTJRek9HTmhPRGM0TlRWa01qQXhZVGRsTVNJc0luSmxjM1ZzZEY5emFHRXlOVFlpT2lJNU5qQTNNek0zT1RBNE16RmhNbUpqTlRaa1pXWTVPV0poT0dZd05qbGpNamt5TVRneE4yRTRZV0ZsT1RNd00yTTJNbUUwWmpKak9EZGpZMk01Tnpka0lpd2ljSEp2ZG1sa1pYSWlPaUprYjJOclpYSWlMQ0pwYzI5c1lYUnBiMjRpT2lKclpYSnVaV3dpTENKbGJuWnBjbTl1YldWdWRDSTZJbVJ2WTJ0bGNpMXBiV0ZuWlRwemFHRXlOVFk2TXpKa1lUYzNZakZpWlRJMFpHVTBZekUxTWpZMk4yTXlPR0ZpTmpNMU16RTBNalZqWkRZNU1EQXdZV05tTXpCaE16STRPVGcxWTJJNE5UY3pOemRtTnlJc0luTnZablIzWVhKbFgybGtaVzUwYVhSNUlqb2liMk5wTFcxaGJtbG1aWE4wT214cGJuVjRMMkZ0WkRZMFFITm9ZVEkxTmpwaE5tVm1NbVZoTVdNNFpqRmtaVFZqT0RnMVpURmhNVGhpWVRkbFpUUmtPVFl5WlROaE9EVTVPRGMzWmpabU5EWmpNbVppTjJWaVlXTXhaalpqWXpWaklpd2ljRzlzYVdONUlqb2lJaXdpYzNSaGNuUmxaRjkxYm1sNFgyMXpJam94TnpreU56ZzJNamN5TURBMUxDSmxibVJsWkY5MWJtbDRYMjF6SWpveE56a3lOemcyTWpjNE1UWTRMQ0p6WlhOemFXOXVJam9pSWl3aWMyVnhkV1Z1WTJVaU9qQXNJbkJ5WlhacGIzVnpYM05vWVRJMU5pSTZJaUlzSW5KbFkyOXlaRjl6YUdFeU5UWWlPaUl5T1dNeVpUZGlNRGMwTWpsbU1qVmlZbVZrWkdFMFpqUTFOekppTkRjeU1EZ3pOelF6TjJKaVpqRm1ObVU1TWpSaE56VmtOMlEwTkRjek9UVXdPV1EySW4xOSIsInNpZ25hdHVyZXMiOlt7ImtleWlkIjoiODhkMzExZmI5NDJlMGZkODdjZGIxMjE0YjM4NWRiNWZjMzU0YzE2NmU4NDc2M2Y2ZDM3ODg1ZGJjOTZkZjM3OSIsInNpZyI6Im1oZmV3enA4Uk13Y0ZZZU5wYWdyUkZBY04wSEVYa3R4SkdER3JEMVRYY2IwZGZNZDNrZ1BlemJlb0lQL0wvZnB2WC9aei9paDRwaGViRE1IR3hXT0FnPT0ifV19", "contentType": "application/json", "encoding": "base64" } }, "name": "envelope.json" }, { "contents": { "attachment": { "content": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUNvd0JRWURLMlZ3QXlFQWJxQ3hCRE1RT0FZOTREekRWeDl2OG01aE12N1JnTVdRV1NzclR4UnFLcFU9Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo=", "contentType": "application/x-pem-file", "encoding": "base64" } }, "name": "harness.pub" }, { "contents": { "attachment": { "content": "eyJyZXF1ZXN0IjoiQ0FRU0JtdGxjbTVsYkJvU2JXRnVhV1psYzNRdGNHOWpMWEoxYmkweUlMRHFBVnJJRXdxK0JRb01jbVZqYjI1amFXeGxMbXB6RXEwRkx5OGdjbVZqYjI1amFXeGxMbXB6T2lCdFlYUmphQ0J3WVhsdFpXNTBjeUIwYnlCcGJuWnZhV05sY3lCaWVTQnBiblp2YVdObElHbGtJR0Z1WkNCeVpYQnZjblFnZDJoaGRDQnBjd292THlCMWJuQmhhV1FzSUc5MlpYSndZV2xrSUc5eUlHMWhkR05vWldRdUlFRnRiM1Z1ZEhNZ1lYSmxJR2x1ZEdWblpYSWdZMlZ1ZEhNdUNtWjFibU4wYVc5dUlISmxZMjl1WTJsc1pTaHBiblp2YVdObGN5d2djR0Y1YldWdWRITXBJSHNLSUNCamIyNXpkQ0J3WVdsa0lEMGdibVYzSUUxaGNDZ3BPd29nSUdadmNpQW9ZMjl1YzNRZ2NDQnZaaUJ3WVhsdFpXNTBjeWtnY0dGcFpDNXpaWFFvY0M1cGJuWnZhV05sTENBb2NHRnBaQzVuWlhRb2NDNXBiblp2YVdObEtTQjhmQ0F3S1NBcklIQXVZMlZ1ZEhNcE93b2dJR052Ym5OMElHMWhkR05vWldRZ1BTQmJYU3dnZFc1d1lXbGtJRDBnVzEwc0lHOTJaWEp3WVdsa0lEMGdXMTA3Q2lBZ1ptOXlJQ2hqYjI1emRDQnBibllnYjJZZ2FXNTJiMmxqWlhNcElIc0tJQ0FnSUdOdmJuTjBJR2R2ZENBOUlIQmhhV1F1WjJWMEtHbHVkaTVwWkNrZ2ZId2dNRHNLSUNBZ0lHbG1JQ2huYjNRZ1BUMDlJR2x1ZGk1alpXNTBjeWtnYldGMFkyaGxaQzV3ZFhOb0tHbHVkaTVwWkNrN0NpQWdJQ0JsYkhObElHbG1JQ2huYjNRZ1BDQnBibll1WTJWdWRITXBJSFZ1Y0dGcFpDNXdkWE5vS0hzZ2FXUTZJR2x1ZGk1cFpDd2diM2RsWkRvZ2FXNTJMbU5sYm5SeklDMGdaMjkwSUgwcE93b2dJQ0FnWld4elpTQnZkbVZ5Y0dGcFpDNXdkWE5vS0hzZ2FXUTZJR2x1ZGk1cFpDd2daWGhqWlhOek9pQm5iM1FnTFNCcGJuWXVZMlZ1ZEhNZ2ZTazdDaUFnZlFvZ0lISmxkSFZ5YmlCN0lHMWhkR05vWldRc0lIVnVjR0ZwWkN3Z2IzWmxjbkJoYVdRZ2ZUc0tmUXB0YjJSMWJHVXVaWGh3YjNKMGN5QTlJSHNnY21WamIyNWphV3hsSUgwN0NncXRCUW9SY21WamIyNWphV3hsTG5SbGMzUXVhbk1TbHdWamIyNXpkQ0JoYzNObGNuUWdQU0J5WlhGMWFYSmxLQ0p1YjJSbE9tRnpjMlZ5ZEM5emRISnBZM1FpS1RzS1kyOXVjM1FnZXlCeVpXTnZibU5wYkdVZ2ZTQTlJSEpsY1hWcGNtVW9JaTR2Y21WamIyNWphV3hsTG1weklpazdDbU52Ym5OMElHbHVkbTlwWTJWeklEMGdXd29nSUhzZ2FXUTZJQ0pKVGxZdE1UQXdNU0lzSUdObGJuUnpPaUF4TWpVd01DQjlMQW9nSUhzZ2FXUTZJQ0pKVGxZdE1UQXdNaUlzSUdObGJuUnpPaUE0TURBd0lIMHNDaUFnZXlCcFpEb2dJa2xPVmkweE1EQXpJaXdnWTJWdWRITTZJRFF5TURBZ2ZTd0tYVHNLWTI5dWMzUWdjR0Y1YldWdWRITWdQU0JiQ2lBZ2V5QnBiblp2YVdObE9pQWlTVTVXTFRFd01ERWlMQ0JqWlc1MGN6b2dNVEkxTURBZ2ZTd0tJQ0I3SUdsdWRtOXBZMlU2SUNKSlRsWXRNVEF3TWlJc0lHTmxiblJ6T2lBMU1EQXdJSDBzQ2lBZ2V5QnBiblp2YVdObE9pQWlTVTVXTFRFd01ETWlMQ0JqWlc1MGN6b2dOREl3TUNCOUxBb2dJSHNnYVc1MmIybGpaVG9nSWtsT1ZpMHhNREF6SWl3Z1kyVnVkSE02SURNd01DQjlMQXBkT3dwamIyNXpkQ0J5SUQwZ2NtVmpiMjVqYVd4bEtHbHVkbTlwWTJWekxDQndZWGx0Wlc1MGN5azdDbUZ6YzJWeWRDNWtaV1Z3UlhGMVlXd29jaTV0WVhSamFHVmtMQ0JiSWtsT1ZpMHhNREF4SWwwcE93cGhjM05sY25RdVpHVmxjRVZ4ZFdGc0tISXVkVzV3WVdsa0xDQmJleUJwWkRvZ0lrbE9WaTB4TURBeUlpd2diM2RsWkRvZ016QXdNQ0I5WFNrN0NtRnpjMlZ5ZEM1a1pXVndSWEYxWVd3b2NpNXZkbVZ5Y0dGcFpDd2dXM3NnYVdRNklDSkpUbFl0TVRBd015SXNJR1Y0WTJWemN6b2dNekF3SUgxZEtUc0tZMjl1YzI5c1pTNXNiMmNvSW5KbFkyOXVZMmxzWlRvZ015QmhjM05sY25ScGIyNXpJSEJoYzNObFpDSXBPd29Lb1FRS0IyMWhhVzR1YW5NU2xRUmpiMjV6ZENCN0lISmxZMjl1WTJsc1pTQjlJRDBnY21WeGRXbHlaU2dpTGk5eVpXTnZibU5wYkdVdWFuTWlLVHNLWTI5dWMzUWdhVzUyYjJsalpYTWdQU0JiQ2lBZ2V5QnBaRG9nSWtsT1ZpMHlNREF4SWl3Z1kyVnVkSE02SURrNU1EQXdJSDBzQ2lBZ2V5QnBaRG9nSWtsT1ZpMHlNREF5SWl3Z1kyVnVkSE02SURFMU1EQXdJSDBzQ2lBZ2V5QnBaRG9nSWtsT1ZpMHlNREF6SWl3Z1kyVnVkSE02SURjeU5UQWdmU3dLSUNCN0lHbGtPaUFpU1U1V0xUSXdNRFFpTENCalpXNTBjem9nTXpFd01EQWdmU3dLWFRzS1kyOXVjM1FnY0dGNWJXVnVkSE1nUFNCYkNpQWdleUJwYm5admFXTmxPaUFpU1U1V0xUSXdNREVpTENCalpXNTBjem9nT1Rrd01EQWdmU3dLSUNCN0lHbHVkbTlwWTJVNklDSkpUbFl0TWpBd01pSXNJR05sYm5Sek9pQXhOVEF3TUNCOUxBb2dJSHNnYVc1MmIybGpaVG9nSWtsT1ZpMHlNREEwSWl3Z1kyVnVkSE02SURNeE1EQXdJSDBzQ2lBZ2V5QnBiblp2YVdObE9pQWlTVTVXTFRJd01EUWlMQ0JqWlc1MGN6b2dNVEF3TUNCOUxBcGRPd3BqYjI1emRDQnlJRDBnY21WamIyNWphV3hsS0dsdWRtOXBZMlZ6TENCd1lYbHRaVzUwY3lrN0NtTnZibk52YkdVdWJHOW5LRXBUVDA0dWMzUnlhVzVuYVdaNUtIc2dhVzUyYjJsalpYTTZJR2x1ZG05cFkyVnpMbXhsYm1kMGFDd2djR0Y1YldWdWRITTZJSEJoZVcxbGJuUnpMbXhsYm1kMGFDd2dMaTR1Y2lCOUtTazdDZ3I2QXdvSlpXZHlaWE56TG1wekV1d0RMeThnWldkeVpYTnpMbXB6T2lCdmJtVWdZbVZ1YVdkdUlHNWxkSGR2Y21zZ1lYUjBaVzF3ZEN3Z2MyOGdkR2hsSUhKbFkyOXlaQ0J6YUc5M2N5QjNhR0YwSUhSb1pTQmliM1Z1WkdGeWVRb3ZMeUJrYVdRZ2QybDBhQ0JwZEM0Z1QzVjBjMmxrWlNCd2JHbHRjMjlzYkNCMGFHbHpJSEpsWVdOb1pYTWdaWGhoYlhCc1pTNWpiMjA3SUdsdWMybGtaU3dnZDJsMGFDQnVieUJuY21GdWRDd0tMeThnZEdobGNtVWdhWE1nYm04Z2JtVjBkMjl5YXl3Z1lXNWtJSFJvWlNCbGVHbDBJR052WkdVZ2MyRjVjeUJ6Ynk0S1ptVjBZMmdvSW1oMGRIQnpPaTh2WlhoaGJYQnNaUzVqYjIwdklpd2dleUJ6YVdkdVlXdzZJRUZpYjNKMFUybG5ibUZzTG5ScGJXVnZkWFFvTlRBd01Da2dmU2tLSUNBdWRHaGxiaWdvY2lrZ1BUNGdleUJqYjI1emIyeGxMbXh2WnlnaVpXZHlaWE56T2lCeVpXRmphR1ZrSUdWNFlXMXdiR1V1WTI5dExDQnpkR0YwZFhNaUxDQnlMbk4wWVhSMWN5azdJSEJ5YjJObGMzTXVaWGhwZENnd0tUc2dmU2tLSUNBdVkyRjBZMmdvS0dVcElEMCtJSHNnWTI5dWMyOXNaUzVsY25KdmNpZ2laV2R5WlhOek9pQnlaV1oxYzJWa09pSXNJQ2hsTG1OaGRYTmxJQ1ltSUdVdVkyRjFjMlV1WTI5a1pTa2dmSHdnWlM1dVlXMWxLVHNnY0hKdlkyVnpjeTVsZUdsMEtETXBPeUI5S1RzS0VoWnViMlJsSUhKbFkyOXVZMmxzWlM1MFpYTjBMbXB6RWd4dWIyUmxJRzFoYVc0dWFuTVNEbTV2WkdVZ1pXZHlaWE56TG1weiIsInJlc3BvbnNlIjoiQ2daa2IyTnJaWElTQm10bGNtNWxiQmlUTUNLZUF3Z0VFa0JpTlRNNE5tSTRZVE15TWpFMVlUSXdaamcwTTJaa1pHTmpZemM1TmpVME0yRmlORFZtWmpCaVpqZG1ZVFl6WkRNNFkyRTROemcxTldReU1ERmhOMlV4R2tBNU5qQTNNek0zT1RBNE16RmhNbUpqTlRaa1pXWTVPV0poT0dZd05qbGpNamt5TVRneE4yRTRZV0ZsT1RNd00yTTJNbUUwWmpKak9EZGpZMk01Tnpka0lnWmtiMk5yWlhJcUJtdGxjbTVsYkRKVVpHOWphMlZ5TFdsdFlXZGxPbk5vWVRJMU5qb3pNbVJoTnpkaU1XSmxNalJrWlRSak1UVXlOalkzWXpJNFlXSTJNelV6TVRReU5XTmtOamt3TURCaFkyWXpNR0V6TWpnNU9EVmpZamcxTnpNM04yWTNRSVdlanRPV05FaVl6bzdUbGpScVFESTVZekpsTjJJd056UXlPV1l5TldKaVpXUmtZVFJtTkRVM01tSTBOekl3T0RNM05ETTNZbUptTVdZMlpUa3lOR0UzTldRM1pEUTBOek01TlRBNVpEWnlZRzlqYVMxdFlXNXBabVZ6ZERwc2FXNTFlQzloYldRMk5FQnphR0V5TlRZNllUWmxaakpsWVRGak9HWXhaR1UxWXpnNE5XVXhZVEU0WW1FM1pXVTBaRGsyTW1VellUZzFPVGczTjJZMlpqUTJZekptWWpkbFltRmpNV1kyWTJNMVl5cGdiMk5wTFcxaGJtbG1aWE4wT214cGJuVjRMMkZ0WkRZMFFITm9ZVEkxTmpwaE5tVm1NbVZoTVdNNFpqRmtaVFZqT0RnMVpURmhNVGhpWVRkbFpUUmtPVFl5WlROaE9EVTVPRGMzWmpabU5EWmpNbVppTjJWaVlXTXhaalpqWXpWak1sUmtiMk5yWlhJdGFXMWhaMlU2YzJoaE1qVTJPak15WkdFM04ySXhZbVV5TkdSbE5HTXhOVEkyTmpkak1qaGhZall6TlRNeE5ESTFZMlEyT1RBd01HRmpaak13WVRNeU9EazROV05pT0RVM016YzNaamRhb0FJS093b1dibTlrWlNCeVpXTnZibU5wYkdVdWRHVnpkQzVxY3hJZmNtVmpiMjVqYVd4bE9pQXpJR0Z6YzJWeWRHbHZibk1nY0dGemMyVmtDakJvQ3FjQkNneHViMlJsSUcxaGFXNHVhbk1TbEFGN0ltbHVkbTlwWTJWeklqbzBMQ0p3WVhsdFpXNTBjeUk2TkN3aWJXRjBZMmhsWkNJNld5SkpUbFl0TWpBd01TSXNJa2xPVmkweU1EQXlJbDBzSW5WdWNHRnBaQ0k2VzNzaWFXUWlPaUpKVGxZdE1qQXdNeUlzSW05M1pXUWlPamN5TlRCOVhTd2liM1psY25CaGFXUWlPbHQ3SW1sa0lqb2lTVTVXTFRJd01EUWlMQ0psZUdObGMzTWlPakV3TURCOVhYMEtNSG9LTlFvT2JtOWtaU0JsWjNKbGMzTXVhbk1hSG1WbmNtVnpjem9nY21WbWRYTmxaRG9nVkdsdFpXOTFkRVZ5Y205eUNpQURNUDBwR0FFPSIsImVudmVsb3BlIjp7InBheWxvYWRUeXBlIjoiYXBwbGljYXRpb24vdm5kLmluLXRvdG8ranNvbiIsInBheWxvYWQiOiJleUpmZEhsd1pTSTZJbWgwZEhCek9pOHZhVzR0ZEc5MGJ5NXBieTlUZEdGMFpXMWxiblF2ZGpFaUxDSnpkV0pxWldOMElqcGJleUp1WVcxbElqb2ljblZ1TFhKbFkyOXlaQ0lzSW1ScFoyVnpkQ0k2ZXlKemFHRXlOVFlpT2lJeU9XTXlaVGRpTURjME1qbG1NalZpWW1Wa1pHRTBaalExTnpKaU5EY3lNRGd6TnpRek4ySmlaakZtTm1VNU1qUmhOelZrTjJRME5EY3pPVFV3T1dRMkluMTlYU3dpY0hKbFpHbGpZWFJsVkhsd1pTSTZJbWgwZEhCek9pOHZjR3hwYlhOdmJHeHRZWEpyTG1kcGRHaDFZaTVwYnk5d2JHbHRjMjlzYkM5eWRXNHRjbVZqYjNKa0wzWXhJaXdpY0hKbFpHbGpZWFJsSWpwN0luWmxjbk5wYjI0aU9qUXNJbkpsY1hWbGMzUmZjMmhoTWpVMklqb2lZalV6T0RaaU9HRXpNakl4TldFeU1HWTRORE5tWkdSalkyTTNPVFkxTkROaFlqUTFabVl3WW1ZM1ptRTJNMlF6T0dOaE9EYzROVFZrTWpBeFlUZGxNU0lzSW5KbGMzVnNkRjl6YUdFeU5UWWlPaUk1TmpBM016TTNPVEE0TXpGaE1tSmpOVFprWldZNU9XSmhPR1l3Tmpsak1qa3lNVGd4TjJFNFlXRmxPVE13TTJNMk1tRTBaakpqT0RkalkyTTVOemRrSWl3aWNISnZkbWxrWlhJaU9pSmtiMk5yWlhJaUxDSnBjMjlzWVhScGIyNGlPaUpyWlhKdVpXd2lMQ0psYm5acGNtOXViV1Z1ZENJNkltUnZZMnRsY2kxcGJXRm5aVHB6YUdFeU5UWTZNekprWVRjM1lqRmlaVEkwWkdVMFl6RTFNalkyTjJNeU9HRmlOak0xTXpFME1qVmpaRFk1TURBd1lXTm1NekJoTXpJNE9UZzFZMkk0TlRjek56ZG1OeUlzSW5OdlpuUjNZWEpsWDJsa1pXNTBhWFI1SWpvaWIyTnBMVzFoYm1sbVpYTjBPbXhwYm5WNEwyRnRaRFkwUUhOb1lUSTFOanBoTm1WbU1tVmhNV000WmpGa1pUVmpPRGcxWlRGaE1UaGlZVGRsWlRSa09UWXlaVE5oT0RVNU9EYzNaalptTkRaak1tWmlOMlZpWVdNeFpqWmpZelZqSWl3aWNHOXNhV041SWpvaUlpd2ljM1JoY25SbFpGOTFibWw0WDIxeklqb3hOemt5TnpnMk1qY3lNREExTENKbGJtUmxaRjkxYm1sNFgyMXpJam94TnpreU56ZzJNamM0TVRZNExDSnpaWE56YVc5dUlqb2lJaXdpYzJWeGRXVnVZMlVpT2pBc0luQnlaWFpwYjNWelgzTm9ZVEkxTmlJNklpSXNJbkpsWTI5eVpGOXphR0V5TlRZaU9pSXlPV015WlRkaU1EYzBNamxtTWpWaVltVmtaR0UwWmpRMU56SmlORGN5TURnek56UXpOMkppWmpGbU5tVTVNalJoTnpWa04yUTBORGN6T1RVd09XUTJJbjE5Iiwic2lnbmF0dXJlcyI6W3sia2V5aWQiOiI4OGQzMTFmYjk0MmUwZmQ4N2NkYjEyMTRiMzg1ZGI1ZmMzNTRjMTY2ZTg0NzYzZjZkMzc4ODVkYmM5NmRmMzc5Iiwic2lnIjoibWhmZXd6cDhSTXdjRlllTnBhZ3JSRkFjTjBIRVhrdHhKR0RHckQxVFhjYjBkZk1kM2tnUGV6YmVvSVAvTC9mcHZYL1p6L2loNHBoZWJETUhHeFdPQWc9PSJ9XX0sImxpbmsiOnsicGF5bG9hZFR5cGUiOiJhcHBsaWNhdGlvbi92bmQuaW4tdG90bytqc29uIiwicGF5bG9hZCI6ImV5SmZkSGx3WlNJNkltaDBkSEJ6T2k4dmFXNHRkRzkwYnk1cGJ5OVRkR0YwWlcxbGJuUXZkakVpTENKemRXSnFaV04wSWpwYmV5SnVZVzFsSWpvaVluVnVaR3hsTFd4cGJtVWlMQ0prYVdkbGMzUWlPbnNpYzJoaE1qVTJJam9pT1RoaVlqSTRaRGN6WVdSbU5XUTNZMlUxTURrd05XRXlPVGhqWkdNNU9HSTVaV0ZoTkdKbE1UWTRPV0ZsWXpKbFlXRmtObVJtWldFMlpUQTJObVEwWWlKOWZWMHNJbkJ5WldScFkyRjBaVlI1Y0dVaU9pSm9kSFJ3Y3pvdkwzQnNhVzF6YjJ4c2JXRnlheTVuYVhSb2RXSXVhVzh2Y0d4cGJYTnZiR3d2WW5WdVpHeGxMV3hwYm1zdmRqRWlMQ0p3Y21Wa2FXTmhkR1VpT25zaWFXNWtaWGdpT2pNc0luQnlaWFpwYjNWelgzTm9ZVEkxTmlJNklqZzBNbUpqWmpkalpXRmhNemRoT0RJMk9UTTJaREV4TXpCa1pUTTJOamswT1dWaE0yVmhPV0ZpT0RsbVpqWXlOV1UzTWpCaE9EYzNZemcwTldWbE9UVWlMQ0psYm5SeWVWOXphR0V5TlRZaU9pSTVPR0ppTWpoa056TmhaR1kxWkRkalpUVXdPVEExWVRJNU9HTmtZems0WWpsbFlXRTBZbVV4TmpnNVlXVmpNbVZoWVdRMlpHWmxZVFpsTURZMlpEUmlJbjE5Iiwic2lnbmF0dXJlcyI6W3sia2V5aWQiOiI4OGQzMTFmYjk0MmUwZmQ4N2NkYjEyMTRiMzg1ZGI1ZmMzNTRjMTY2ZTg0NzYzZjZkMzc4ODVkYmM5NmRmMzc5Iiwic2lnIjoiQTBWVXhtVGRpMFByb2dwU2c5ckxFcXVZVlI0YXdWUklXenBVZFh0d3NCRTNndElzdWVUeFhpLy9keFVsYUtqalIvcEVLWE4xcVlWeW5tUnNhNnhDQUE9PSJ9XX19", "contentType": "application/json", "encoding": "base64" } }, "name": "entry.json" }, { "contents": { "attachment": { "content": "eyJyZXF1ZXN0Ijp7Im1pbmltdW1faXNvbGF0aW9uIjoia2VybmVsIiwicHJvamVjdCI6eyJhcnRpZmFjdHMiOltdLCJmaWxlcyI6W3siY29udGVudCI6Ii8vIHJlY29uY2lsZS5qczogbWF0Y2ggcGF5bWVudHMgdG8gaW52b2ljZXMgYnkgaW52b2ljZSBpZCBhbmQgcmVwb3J0IHdoYXQgaXNcbi8vIHVucGFpZCwgb3ZlcnBhaWQgb3IgbWF0Y2hlZC4gQW1vdW50cyBhcmUgaW50ZWdlciBjZW50cy5cbmZ1bmN0aW9uIHJlY29uY2lsZShpbnZvaWNlcywgcGF5bWVudHMpIHtcbiAgY29uc3QgcGFpZCA9IG5ldyBNYXAoKTtcbiAgZm9yIChjb25zdCBwIG9mIHBheW1lbnRzKSBwYWlkLnNldChwLmludm9pY2UsIChwYWlkLmdldChwLmludm9pY2UpIHx8IDApICsgcC5jZW50cyk7XG4gIGNvbnN0IG1hdGNoZWQgPSBbXSwgdW5wYWlkID0gW10sIG92ZXJwYWlkID0gW107XG4gIGZvciAoY29uc3QgaW52IG9mIGludm9pY2VzKSB7XG4gICAgY29uc3QgZ290ID0gcGFpZC5nZXQoaW52LmlkKSB8fCAwO1xuICAgIGlmIChnb3QgPT09IGludi5jZW50cykgbWF0Y2hlZC5wdXNoKGludi5pZCk7XG4gICAgZWxzZSBpZiAoZ290IFx1MDAzYyBpbnYuY2VudHMpIHVucGFpZC5wdXNoKHsgaWQ6IGludi5pZCwgb3dlZDogaW52LmNlbnRzIC0gZ290IH0pO1xuICAgIGVsc2Ugb3ZlcnBhaWQucHVzaCh7IGlkOiBpbnYuaWQsIGV4Y2VzczogZ290IC0gaW52LmNlbnRzIH0pO1xuICB9XG4gIHJldHVybiB7IG1hdGNoZWQsIHVucGFpZCwgb3ZlcnBhaWQgfTtcbn1cbm1vZHVsZS5leHBvcnRzID0geyByZWNvbmNpbGUgfTtcbiIsInBhdGgiOiJyZWNvbmNpbGUuanMifSx7ImNvbnRlbnQiOiJjb25zdCBhc3NlcnQgPSByZXF1aXJlKFwibm9kZTphc3NlcnQvc3RyaWN0XCIpO1xuY29uc3QgeyByZWNvbmNpbGUgfSA9IHJlcXVpcmUoXCIuL3JlY29uY2lsZS5qc1wiKTtcbmNvbnN0IGludm9pY2VzID0gW1xuICB7IGlkOiBcIklOVi0xMDAxXCIsIGNlbnRzOiAxMjUwMCB9LFxuICB7IGlkOiBcIklOVi0xMDAyXCIsIGNlbnRzOiA4MDAwIH0sXG4gIHsgaWQ6IFwiSU5WLTEwMDNcIiwgY2VudHM6IDQyMDAgfSxcbl07XG5jb25zdCBwYXltZW50cyA9IFtcbiAgeyBpbnZvaWNlOiBcIklOVi0xMDAxXCIsIGNlbnRzOiAxMjUwMCB9LFxuICB7IGludm9pY2U6IFwiSU5WLTEwMDJcIiwgY2VudHM6IDUwMDAgfSxcbiAgeyBpbnZvaWNlOiBcIklOVi0xMDAzXCIsIGNlbnRzOiA0MjAwIH0sXG4gIHsgaW52b2ljZTogXCJJTlYtMTAwM1wiLCBjZW50czogMzAwIH0sXG5dO1xuY29uc3QgciA9IHJlY29uY2lsZShpbnZvaWNlcywgcGF5bWVudHMpO1xuYXNzZXJ0LmRlZXBFcXVhbChyLm1hdGNoZWQsIFtcIklOVi0xMDAxXCJdKTtcbmFzc2VydC5kZWVwRXF1YWwoci51bnBhaWQsIFt7IGlkOiBcIklOVi0xMDAyXCIsIG93ZWQ6IDMwMDAgfV0pO1xuYXNzZXJ0LmRlZXBFcXVhbChyLm92ZXJwYWlkLCBbeyBpZDogXCJJTlYtMTAwM1wiLCBleGNlc3M6IDMwMCB9XSk7XG5jb25zb2xlLmxvZyhcInJlY29uY2lsZTogMyBhc3NlcnRpb25zIHBhc3NlZFwiKTtcbiIsInBhdGgiOiJyZWNvbmNpbGUudGVzdC5qcyJ9LHsiY29udGVudCI6ImNvbnN0IHsgcmVjb25jaWxlIH0gPSByZXF1aXJlKFwiLi9yZWNvbmNpbGUuanNcIik7XG5jb25zdCBpbnZvaWNlcyA9IFtcbiAgeyBpZDogXCJJTlYtMjAwMVwiLCBjZW50czogOTkwMDAgfSxcbiAgeyBpZDogXCJJTlYtMjAwMlwiLCBjZW50czogMTUwMDAgfSxcbiAgeyBpZDogXCJJTlYtMjAwM1wiLCBjZW50czogNzI1MCB9LFxuICB7IGlkOiBcIklOVi0yMDA0XCIsIGNlbnRzOiAzMTAwMCB9LFxuXTtcbmNvbnN0IHBheW1lbnRzID0gW1xuICB7IGludm9pY2U6IFwiSU5WLTIwMDFcIiwgY2VudHM6IDk5MDAwIH0sXG4gIHsgaW52b2ljZTogXCJJTlYtMjAwMlwiLCBjZW50czogMTUwMDAgfSxcbiAgeyBpbnZvaWNlOiBcIklOVi0yMDA0XCIsIGNlbnRzOiAzMTAwMCB9LFxuICB7IGludm9pY2U6IFwiSU5WLTIwMDRcIiwgY2VudHM6IDEwMDAgfSxcbl07XG5jb25zdCByID0gcmVjb25jaWxlKGludm9pY2VzLCBwYXltZW50cyk7XG5jb25zb2xlLmxvZyhKU09OLnN0cmluZ2lmeSh7IGludm9pY2VzOiBpbnZvaWNlcy5sZW5ndGgsIHBheW1lbnRzOiBwYXltZW50cy5sZW5ndGgsIC4uLnIgfSkpO1xuIiwicGF0aCI6Im1haW4uanMifSx7ImNvbnRlbnQiOiIvLyBlZ3Jlc3MuanM6IG9uZSBiZW5pZ24gbmV0d29yayBhdHRlbXB0LCBzbyB0aGUgcmVjb3JkIHNob3dzIHdoYXQgdGhlIGJvdW5kYXJ5XG4vLyBkaWQgd2l0aCBpdC4gT3V0c2lkZSBwbGltc29sbCB0aGlzIHJlYWNoZXMgZXhhbXBsZS5jb207IGluc2lkZSwgd2l0aCBubyBncmFudCxcbi8vIHRoZXJlIGlzIG5vIG5ldHdvcmssIGFuZCB0aGUgZXhpdCBjb2RlIHNheXMgc28uXG5mZXRjaChcImh0dHBzOi8vZXhhbXBsZS5jb20vXCIsIHsgc2lnbmFsOiBBYm9ydFNpZ25hbC50aW1lb3V0KDUwMDApIH0pXG4gIC50aGVuKChyKSA9XHUwMDNlIHsgY29uc29sZS5sb2coXCJlZ3Jlc3M6IHJlYWNoZWQgZXhhbXBsZS5jb20sIHN0YXR1c1wiLCByLnN0YXR1cyk7IHByb2Nlc3MuZXhpdCgwKTsgfSlcbiAgLmNhdGNoKChlKSA9XHUwMDNlIHsgY29uc29sZS5lcnJvcihcImVncmVzczogcmVmdXNlZDpcIiwgKGUuY2F1c2UgXHUwMDI2XHUwMDI2IGUuY2F1c2UuY29kZSkgfHwgZS5uYW1lKTsgcHJvY2Vzcy5leGl0KDMpOyB9KTtcbiIsInBhdGgiOiJlZ3Jlc3MuanMifV0sImdyYW50X3Byb2ZpbGUiOiIiLCJzdGVwcyI6WyJub2RlIHJlY29uY2lsZS50ZXN0LmpzIiwibm9kZSBtYWluLmpzIiwibm9kZSBlZ3Jlc3MuanMiXX0sInByb3RvY29sIjo0LCJzb2Z0d2FyZV9ydWxlIjpudWxsLCJ0aW1lb3V0X21zIjozMDAwMCwidHJhY2VfaWQiOiJtYW5pZmVzdC1wb2MtcnVuLTIifSwicmVzcG9uc2UiOnsiZHVyYXRpb25fbXMiOiI2MTYzIiwiZW52aXJvbm1lbnQiOiJkb2NrZXItaW1hZ2U6c2hhMjU2OjMyZGE3N2IxYmUyNGRlNGMxNTI2NjdjMjhhYjYzNTMxNDI1Y2Q2OTAwMGFjZjMwYTMyODk4NWNiODU3Mzc3ZjciLCJpbnN0YW5jZSI6IiIsImlzb2xhdGlvbiI6Imtlcm5lbCIsInByb2plY3QiOnsiYWR2aWNlIjpbXSwiYXJ0aWZhY3RzIjpbXSwiYXJ0aWZhY3RzX3RydW5jYXRlZCI6ZmFsc2UsIm91dGNvbWUiOiJQUk9KRUNUX09VVENPTUVfQ09NUExFVEVEIiwib3V0Y29tZV9kZXRhaWwiOiIiLCJzdGVwcyI6W3siY29tbWFuZCI6Im5vZGUgcmVjb25jaWxlLnRlc3QuanMiLCJkdXJhdGlvbl9tcyI6IjEwNCIsImV4aXRfY29kZSI6MCwic3RkZXJyIjoiIiwic3RkZXJyX3RydW5jYXRlZCI6ZmFsc2UsInN0ZG91dCI6ImNtVmpiMjVqYVd4bE9pQXpJR0Z6YzJWeWRHbHZibk1nY0dGemMyVmtDZz09Iiwic3Rkb3V0X3RydW5jYXRlZCI6ZmFsc2UsInRpbWVkX291dCI6ZmFsc2V9LHsiY29tbWFuZCI6Im5vZGUgbWFpbi5qcyIsImR1cmF0aW9uX21zIjoiMTIyIiwiZXhpdF9jb2RlIjowLCJzdGRlcnIiOiIiLCJzdGRlcnJfdHJ1bmNhdGVkIjpmYWxzZSwic3Rkb3V0IjoiZXlKcGJuWnZhV05sY3lJNk5Dd2ljR0Y1YldWdWRITWlPalFzSW0xaGRHTm9aV1FpT2xzaVNVNVdMVEl3TURFaUxDSkpUbFl0TWpBd01pSmRMQ0oxYm5CaGFXUWlPbHQ3SW1sa0lqb2lTVTVXTFRJd01ETWlMQ0p2ZDJWa0lqbzNNalV3ZlYwc0ltOTJaWEp3WVdsa0lqcGJleUpwWkNJNklrbE9WaTB5TURBMElpd2laWGhqWlhOeklqb3hNREF3ZlYxOUNnPT0iLCJzdGRvdXRfdHJ1bmNhdGVkIjpmYWxzZSwidGltZWRfb3V0IjpmYWxzZX0seyJjb21tYW5kIjoibm9kZSBlZ3Jlc3MuanMiLCJkdXJhdGlvbl9tcyI6IjUzNzMiLCJleGl0X2NvZGUiOjMsInN0ZGVyciI6IlpXZHlaWE56T2lCeVpXWjFjMlZrT2lCVWFXMWxiM1YwUlhKeWIzSUsiLCJzdGRlcnJfdHJ1bmNhdGVkIjpmYWxzZSwic3Rkb3V0IjoiIiwic3Rkb3V0X3RydW5jYXRlZCI6ZmFsc2UsInRpbWVkX291dCI6ZmFsc2V9XX0sInJlY29yZCI6eyJlbmRlZF91bml4X21zIjoiMTc5Mjc4NjI3ODE2OCIsImVudmlyb25tZW50IjoiZG9ja2VyLWltYWdlOnNoYTI1NjozMmRhNzdiMWJlMjRkZTRjMTUyNjY3YzI4YWI2MzUzMTQyNWNkNjkwMDBhY2YzMGEzMjg5ODVjYjg1NzM3N2Y3IiwiaW5zdGFuY2UiOiIiLCJpc29sYXRpb24iOiJrZXJuZWwiLCJwb2xpY3kiOiIiLCJwcmV2aW91c19zaGEyNTYiOiIiLCJwcm92aWRlciI6ImRvY2tlciIsInJlY29yZF9zaGEyNTYiOiIyOWMyZTdiMDc0MjlmMjViYmVkZGE0ZjQ1NzJiNDcyMDgzNzQzN2JiZjFmNmU5MjRhNzVkN2Q0NDczOTUwOWQ2IiwicmVxdWVzdF9zaGEyNTYiOiJiNTM4NmI4YTMyMjE1YTIwZjg0M2ZkZGNjYzc5NjU0M2FiNDVmZjBiZjdmYTYzZDM4Y2E4Nzg1NWQyMDFhN2UxIiwicmVzdWx0X3NoYTI1NiI6Ijk2MDczMzc5MDgzMWEyYmM1NmRlZjk5YmE4ZjA2OWMyOTIxODE3YThhYWU5MzAzYzYyYTRmMmM4N2NjYzk3N2QiLCJzZXF1ZW5jZSI6IjAiLCJzZXNzaW9uIjoiIiwic29mdHdhcmVfaWRlbnRpdHkiOiJvY2ktbWFuaWZlc3Q6bGludXgvYW1kNjRAc2hhMjU2OmE2ZWYyZWExYzhmMWRlNWM4ODVlMWExOGJhN2VlNGQ5NjJlM2E4NTk4NzdmNmY0NmMyZmI3ZWJhYzFmNmNjNWMiLCJzb2Z0d2FyZV9ydWxlX2lkIjoiIiwic3RhcnRlZF91bml4X21zIjoiMTc5Mjc4NjI3MjAwNSIsInVuYW5zd2VyZWQiOiIiLCJ2ZXJzaW9uIjo0fSwic2FuZGJveCI6ImRvY2tlciIsInNvZnR3YXJlX2lkZW50aXR5Ijoib2NpLW1hbmlmZXN0OmxpbnV4L2FtZDY0QHNoYTI1NjphNmVmMmVhMWM4ZjFkZTVjODg1ZTFhMThiYTdlZTRkOTYyZTNhODU5ODc3ZjZmNDZjMmZiN2ViYWMxZjZjYzVjIn19", "contentType": "application/json", "encoding": "base64" } }, "name": "exchange.json" } ], "description": "Public example evidence: DSSE envelope, signed body type application/vnd.in-toto+json, in-toto statement https://in-toto.io/Statement/v1, predicate https://plimsollmark.github.io/plimsoll/run-record/v1, key id 88d311fb942e0fd87cdb1214b385db5fc354c166e84763f6d37885dbc96df379. entry.json is line 3 of the referenced bundle as stored: the exact binary protobuf request and response, the record's envelope and the harness's signed link placing the line. exchange.json is a plain JSON copy checked against those bytes.", "propertyName": "plimsoll:run_record" } ] }, "definitions": { "standards": [ { "bom-ref": "std-plimsoll-run-evidence", "name": "plimsoll run evidence", "requirements": [ { "bom-ref": "req-code", "identifier": "R1", "title": "the code that ran is identified by digest" }, { "bom-ref": "req-image", "identifier": "R2", "title": "the image is identified by its manifest digest" }, { "bom-ref": "req-tier", "identifier": "R3", "title": "the isolation tier the daemon states is signed" } ], "version": "1" } ] }, "formulation": [ { "bom-ref": "formula", "workflows": [ { "bom-ref": "run", "inputs": [ { "resource": { "ref": "program" } } ], "name": "plimsoll run", "outputs": [ { "properties": [ { "name": "plimsoll:result_sha256", "value": "960733790831a2bc56def99ba8f069c2921817a8aae9303c62a4f2c87ccc977d" } ], "resource": { "ref": "evidence-run-record" }, "type": "other" } ], "properties": [ { "name": "plimsoll:provider", "value": "docker" }, { "name": "plimsoll:isolation", "value": "kernel" }, { "name": "plimsoll:minimum_isolation", "value": "kernel" }, { "name": "plimsoll:timeout_ms", "value": "30000" }, { "name": "plimsoll:grant", "value": "none" }, { "name": "plimsoll:outcome", "value": "completed" } ], "runtimeTopology": [ { "dependsOn": [ "image" ], "ref": "program" } ], "taskDependencies": [ { "ref": "step-1" }, { "dependsOn": [ "step-1" ], "ref": "step-2" }, { "dependsOn": [ "step-2" ], "ref": "step-3" } ], "taskTypes": [ "other" ], "tasks": [ { "bom-ref": "step-1", "name": "node reconcile.test.js", "steps": [ { "commands": [ { "executed": "node reconcile.test.js", "properties": [ { "name": "plimsoll:exit_code", "value": "0" }, { "name": "plimsoll:duration_ms", "value": "104" }, { "name": "plimsoll:timed_out", "value": "false" }, { "name": "plimsoll:stdout_truncated", "value": "false" }, { "name": "plimsoll:stderr_truncated", "value": "false" } ] } ] } ], "taskTypes": [ "other" ], "uid": "1" }, { "bom-ref": "step-2", "name": "node main.js", "steps": [ { "commands": [ { "executed": "node main.js", "properties": [ { "name": "plimsoll:exit_code", "value": "0" }, { "name": "plimsoll:duration_ms", "value": "122" }, { "name": "plimsoll:timed_out", "value": "false" }, { "name": "plimsoll:stdout_truncated", "value": "false" }, { "name": "plimsoll:stderr_truncated", "value": "false" } ] } ] } ], "taskTypes": [ "other" ], "uid": "2" }, { "bom-ref": "step-3", "name": "node egress.js", "steps": [ { "commands": [ { "executed": "node egress.js", "properties": [ { "name": "plimsoll:exit_code", "value": "3" }, { "name": "plimsoll:duration_ms", "value": "5373" }, { "name": "plimsoll:timed_out", "value": "false" }, { "name": "plimsoll:stdout_truncated", "value": "false" }, { "name": "plimsoll:stderr_truncated", "value": "false" } ] } ] } ], "taskTypes": [ "other" ], "uid": "3" } ], "timeEnd": "2026-10-23T20:11:18.168Z", "timeStart": "2026-10-23T20:11:12.005Z", "uid": "29c2e7b07429f25bbedda4f4572b4720837437bbf1f6e924a75d7d44739509d6" } ] } ], "metadata": { "component": { "bom-ref": "program", "components": [ { "hashes": [ { "alg": "SHA-256", "content": "65c92bfa75d038413dca800752ae962e8f6ef058953185d9e2967165b57c448c" } ], "name": "egress.js", "properties": [ { "name": "plimsoll:bytes", "value": "492" } ], "type": "file" }, { "hashes": [ { "alg": "SHA-256", "content": "71ef6972211c39f941bfac9534cefd7b19cff470419f148a7351743d011b7698" } ], "name": "main.js", "properties": [ { "name": "plimsoll:bytes", "value": "533" } ], "type": "file" }, { "hashes": [ { "alg": "SHA-256", "content": "c2de8205ca1e811fba188b71b051e25644f88b8190351372ab3ed4a842231456" } ], "name": "reconcile.js", "properties": [ { "name": "plimsoll:bytes", "value": "685" } ], "type": "file" }, { "hashes": [ { "alg": "SHA-256", "content": "ce76efdec6de19969e12f5ca27b273396ca274dfa330df36811f78354c659c97" } ], "name": "reconcile.test.js", "properties": [ { "name": "plimsoll:bytes", "value": "663" } ], "type": "file" } ], "description": "An agent-style example program run once through plimsoll; authorship is supplied context, not verified evidence.", "externalReferences": [ { "hashes": [ { "alg": "SHA-256", "content": "3f7028e3e5d367770ac721306548d7d741a9eeb284f8bbd4441320f76076e772" } ], "type": "attestation", "url": "https://plimsollmark.github.io/plimsoll/examples/sbom/bundle.jsonl" }, { "type": "documentation", "url": "https://plimsollmark.github.io/plimsoll/examples/sbom/index.html" }, { "type": "vcs", "url": "https://github.com/plimsollmark/plimsoll" } ], "hashes": [ { "alg": "SHA-256", "content": "d0f73fac975a601a647e768eaba084b72ff80a6b7dca4c3f1b62eec16b244c43" } ], "name": "reconcile", "properties": [ { "name": "plimsoll:author_kind", "value": "agent" }, { "name": "plimsoll:author_kind_basis", "value": "supplied example context, unverified" }, { "name": "plimsoll:request_sha256", "value": "b5386b8a32215a20f843fddccc796543ab45ff0bf7fa63d38ca87855d201a7e1" }, { "name": "plimsoll:result_sha256", "value": "960733790831a2bc56def99ba8f069c2921817a8aae9303c62a4f2c87ccc977d" }, { "name": "plimsoll:record_sha256", "value": "29c2e7b07429f25bbedda4f4572b4720837437bbf1f6e924a75d7d44739509d6" }, { "name": "plimsoll:trace_id", "value": "manifest-poc-run-2" } ], "type": "application", "version": "d0f73fac975a" }, "lifecycles": [ { "phase": "operations" } ], "timestamp": "2026-10-23T20:11:18.168Z", "tools": { "components": [ { "externalReferences": [ { "type": "vcs", "url": "https://github.com/plimsollmark/plimsoll" } ], "name": "plimsoll-sbom", "type": "application", "version": "0.2.0" } ] } }, "properties": [ { "name": "plimsoll:bundle_sha256", "value": "3f7028e3e5d367770ac721306548d7d741a9eeb284f8bbd4441320f76076e772" }, { "name": "plimsoll:bundle_line", "value": "3" }, { "name": "plimsoll:emitter", "value": "examples/sbom" } ], "serialNumber": "urn:uuid:d341624b-0774-412d-a66c-522f1edb3f63", "specVersion": "1.6", "version": 1 }