{ "annotations": [ { "annotator": { "component": { "externalReferences": [ { "type": "vcs", "url": "https://github.com/plimsollmark/plimsoll" } ], "name": "plimsoll-sbom", "type": "application", "version": "0.2.0" } }, "bom-ref": "limits", "subjects": [ "program" ], "text": "The attached run record is signed; this BOM is unsigned. Agent authorship is supplied example context, not a record fact, and the execution layer cannot identify the model. Network isolation is provider configuration, not a separately signed runtime measurement; a granted run reaches only the routes its grant lists, and what reached the other side is not in this record. The run's times are the daemon's own unwitnessed clock. An attached key alone establishes consistency, not signer identity; use an independently trusted key. Display names and the assessor label are unsigned presentation. The attached bundle line proves itself; the whole bundle it belongs to is referenced by digest and checked when supplied. This is run evidence, not an inventory of the image's installed packages.", "timestamp": "2026-10-23T20:21:09.088Z" } ], "bomFormat": "CycloneDX", "components": [ { "bom-ref": "image", "hashes": [ { "alg": "SHA-256", "content": "2c752226d477b4a886378baa95b9af252be59301b725fdb0b7e15208131505a8" } ], "name": "sandbox", "properties": [ { "name": "plimsoll:environment", "value": "dockercloud-image:sha256:2c752226d477b4a886378baa95b9af252be59301b725fdb0b7e15208131505a8" }, { "name": "plimsoll:software_identity", "value": "" } ], "purl": "pkg:oci/sandbox@sha256:2c752226d477b4a886378baa95b9af252be59301b725fdb0b7e15208131505a8", "type": "container", "version": "sha256:2c752226d477b4a886378baa95b9af252be59301b725fdb0b7e15208131505a8" } ], "declarations": { "affirmation": { "statement": "The attached run record was stated by plimsolld, checked and signed by plimsoll-attest, and restated here; plimsoll-attest verify and this program's -check recompute it. This affirmation and BOM are unsigned." }, "assessors": [ { "bom-ref": "assessor", "organization": { "name": "plimsoll examples (self-assessed)" }, "thirdParty": false } ], "attestations": [ { "assessor": "assessor", "map": [ { "claims": [ "claim-code" ], "confidence": { "rationale": "a signature check and a digest recomputation, not a judgement or a probability that the runtime assertion is true", "score": 1 }, "conformance": { "rationale": "The claim matches the signed exchange under a deterministic comparison; this is self-assessed consistency, not independent runtime assurance.", "score": 1 }, "requirement": "req-code" }, { "claims": [ "claim-image" ], "confidence": { "rationale": "a signature check and a digest recomputation, not a judgement or a probability that the runtime assertion is true", "score": 1 }, "conformance": { "rationale": "The claim matches the signed exchange under a deterministic comparison; this is self-assessed consistency, not independent runtime assurance.", "score": 1 }, "requirement": "req-image" }, { "claims": [ "claim-tier" ], "confidence": { "rationale": "a signature check and a digest recomputation, not a judgement or a probability that the runtime assertion is true", "score": 1 }, "conformance": { "rationale": "The claim matches the signed exchange under a deterministic comparison; this is self-assessed consistency, not independent runtime assurance.", "score": 1 }, "requirement": "req-tier" } ], "summary": "A self-assessed restatement of a signed run record with reproducible consistency checks." } ], "claims": [ { "bom-ref": "claim-code", "evidence": [ "evidence-run-record" ], "predicate": "The program's 3 files, file-set digest 6bc21d24ac7a0e21fa02e023551a11d0e3d8ce8310039c4b3c6765609f9c14d8, are the files in the stored request whose signed digest 00c95be443d358949d123d77464e9c40b03dafd3f3094b709d8719b004c0a7a4 covers them with the isolation floor and timeout.", "reasoning": "Each claim restates the run record the daemon stated and the attest harness checked against the stored request and result and signed. The attached bundle line permits those checks to be repeated. This emitter did not observe execution. The tier is configuration and provider evidence plus startup smoke tests, never runtime attestation.", "target": "program" }, { "bom-ref": "claim-image", "evidence": [ "evidence-run-record" ], "predicate": "The daemon states that the run executed in a Docker Cloud microVM booted from the image whose linux/amd64 manifest digest is sha256:2c752226d477b4a886378baa95b9af252be59301b725fdb0b7e15208131505a8 (environment dockercloud-image:sha256:2c752226d477b4a886378baa95b9af252be59301b725fdb0b7e15208131505a8), the provider's pin, which it compares with the digest the cloud reports each sandbox booted and refuses to run on a difference.", "reasoning": "Each claim restates the run record the daemon stated and the attest harness checked against the stored request and result and signed. The attached bundle line permits those checks to be repeated. This emitter did not observe execution. The tier is configuration and provider evidence plus startup smoke tests, never runtime attestation.", "target": "program" }, { "bom-ref": "claim-tier", "evidence": [ "evidence-run-record" ], "predicate": "The daemon states provider dockercloud and isolation tier vm, at or above requested floor kernel, from 2026-10-23T20:21:04.758Z to 2026-10-23T20:21:09.088Z UTC; the stored request names no host-API grant and the result digest is 7a38c50fe500b5827774fc68352cc66a153f44e89e7a7f6d6965f5823ad404d9. The provider's no-grant configuration supplies network isolation; this record is not a network measurement.", "reasoning": "Each claim restates the run record the daemon stated and the attest harness checked against the stored request and result and signed. The attached bundle line permits those checks to be repeated. This emitter did not observe execution. The tier is configuration and provider evidence plus startup smoke tests, never runtime attestation.", "target": "program" } ], "evidence": [ { "author": { "name": "plimsoll-attest key 88d311fb942e0fd87cdb1214b385db5fc354c166e84763f6d37885dbc96df379" }, "bom-ref": "evidence-run-record", "created": "2026-10-23T20:21:09.088Z", "data": [ { "contents": { "attachment": { "content": "eyJwYXlsb2FkVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5pbi10b3RvK2pzb24iLCJwYXlsb2FkIjoiZXlKZmRIbHdaU0k2SW1oMGRIQnpPaTh2YVc0dGRHOTBieTVwYnk5VGRHRjBaVzFsYm5RdmRqRWlMQ0p6ZFdKcVpXTjBJanBiZXlKdVlXMWxJam9pY25WdUxYSmxZMjl5WkNJc0ltUnBaMlZ6ZENJNmV5SnphR0V5TlRZaU9pSmlZalkxWVRBNU1tRTRPV1ZsT0dVMU1qUTBNR0psTm1RMU56QXlPR1ZpWTJSbFlqSTFZalU0WkRrNU1ETm1NV1ppWW1ZeFltVXhPVGszT1RKaE56VmpJbjE5WFN3aWNISmxaR2xqWVhSbFZIbHdaU0k2SW1oMGRIQnpPaTh2Y0d4cGJYTnZiR3h0WVhKckxtZHBkR2gxWWk1cGJ5OXdiR2x0YzI5c2JDOXlkVzR0Y21WamIzSmtMM1l4SWl3aWNISmxaR2xqWVhSbElqcDdJblpsY25OcGIyNGlPalFzSW5KbGNYVmxjM1JmYzJoaE1qVTJJam9pTURCak9UVmlaVFEwTTJRek5UZzVORGxrTVRJelpEYzNORFkwWlRsak5EQmlNRE5rWVdaa00yWXpNRGswWWpjd09XUTROekU1WWpBd05HTXdZVGRoTkNJc0luSmxjM1ZzZEY5emFHRXlOVFlpT2lJM1lUTTRZelV3Wm1VMU1EQmlOVGd5TnpjM05HWmpOamd6TlRKall6WTJZVEUxTTJZME5HVTRPV1UzWVRkbU5tUTJPVFkxWmpVNE1qTmhaRFF3TkdRNUlpd2ljSEp2ZG1sa1pYSWlPaUprYjJOclpYSmpiRzkxWkNJc0ltbHpiMnhoZEdsdmJpSTZJblp0SWl3aVpXNTJhWEp2Ym0xbGJuUWlPaUprYjJOclpYSmpiRzkxWkMxcGJXRm5aVHB6YUdFeU5UWTZNbU0zTlRJeU1qWmtORGMzWWpSaE9EZzJNemM0WW1GaE9UVmlPV0ZtTWpVeVltVTFPVE13TVdJM01qVm1aR0l3WWpkbE1UVXlNRGd4TXpFMU1EVmhPQ0lzSW5CdmJHbGplU0k2SWlJc0luTjBZWEowWldSZmRXNXBlRjl0Y3lJNk1UYzVNamM0TmpnMk5EYzFPQ3dpWlc1a1pXUmZkVzVwZUY5dGN5STZNVGM1TWpjNE5qZzJPVEE0T0N3aWMyVnpjMmx2YmlJNklpSXNJbk5sY1hWbGJtTmxJam93TENKd2NtVjJhVzkxYzE5emFHRXlOVFlpT2lJaUxDSnlaV052Y21SZmMyaGhNalUySWpvaVltSTJOV0V3T1RKaE9EbGxaVGhsTlRJME5EQmlaVFprTlRjd01qaGxZbU5rWldJeU5XSTFPR1E1T1RBelpqRm1ZbUptTVdKbE1UazVOemt5WVRjMVl5SjlmUT09Iiwic2lnbmF0dXJlcyI6W3sia2V5aWQiOiI4OGQzMTFmYjk0MmUwZmQ4N2NkYjEyMTRiMzg1ZGI1ZmMzNTRjMTY2ZTg0NzYzZjZkMzc4ODVkYmM5NmRmMzc5Iiwic2lnIjoiMFFHQWtFSlMyWkg3VWVoc25uaFNVNHBrb3liSWJaQlNmdmxkWWNOaG9yOUVPeDduRXVsbDB5OEg0dnFkSHg5MEhITXhITkxXSVhoWnc5eUVFMG85QWc9PSJ9XX0=", "contentType": "application/json", "encoding": "base64" } }, "name": "envelope.json" }, { "contents": { "attachment": { "content": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUNvd0JRWURLMlZ3QXlFQWJxQ3hCRE1RT0FZOTREekRWeDl2OG01aE12N1JnTVdRV1NzclR4UnFLcFU9Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo=", "contentType": "application/x-pem-file", "encoding": "base64" } }, "name": "harness.pub" }, { "contents": { "attachment": { "content": "eyJyZXF1ZXN0IjoiQ0FRU0JtdGxjbTVsYkJvU2JXRnVhV1psYzNRdGNHOWpMWEoxYmkweElMRHFBVnE3RHdxK0JRb01jbVZqYjI1amFXeGxMbXB6RXEwRkx5OGdjbVZqYjI1amFXeGxMbXB6T2lCdFlYUmphQ0J3WVhsdFpXNTBjeUIwYnlCcGJuWnZhV05sY3lCaWVTQnBiblp2YVdObElHbGtJR0Z1WkNCeVpYQnZjblFnZDJoaGRDQnBjd292THlCMWJuQmhhV1FzSUc5MlpYSndZV2xrSUc5eUlHMWhkR05vWldRdUlFRnRiM1Z1ZEhNZ1lYSmxJR2x1ZEdWblpYSWdZMlZ1ZEhNdUNtWjFibU4wYVc5dUlISmxZMjl1WTJsc1pTaHBiblp2YVdObGN5d2djR0Y1YldWdWRITXBJSHNLSUNCamIyNXpkQ0J3WVdsa0lEMGdibVYzSUUxaGNDZ3BPd29nSUdadmNpQW9ZMjl1YzNRZ2NDQnZaaUJ3WVhsdFpXNTBjeWtnY0dGcFpDNXpaWFFvY0M1cGJuWnZhV05sTENBb2NHRnBaQzVuWlhRb2NDNXBiblp2YVdObEtTQjhmQ0F3S1NBcklIQXVZMlZ1ZEhNcE93b2dJR052Ym5OMElHMWhkR05vWldRZ1BTQmJYU3dnZFc1d1lXbGtJRDBnVzEwc0lHOTJaWEp3WVdsa0lEMGdXMTA3Q2lBZ1ptOXlJQ2hqYjI1emRDQnBibllnYjJZZ2FXNTJiMmxqWlhNcElIc0tJQ0FnSUdOdmJuTjBJR2R2ZENBOUlIQmhhV1F1WjJWMEtHbHVkaTVwWkNrZ2ZId2dNRHNLSUNBZ0lHbG1JQ2huYjNRZ1BUMDlJR2x1ZGk1alpXNTBjeWtnYldGMFkyaGxaQzV3ZFhOb0tHbHVkaTVwWkNrN0NpQWdJQ0JsYkhObElHbG1JQ2huYjNRZ1BDQnBibll1WTJWdWRITXBJSFZ1Y0dGcFpDNXdkWE5vS0hzZ2FXUTZJR2x1ZGk1cFpDd2diM2RsWkRvZ2FXNTJMbU5sYm5SeklDMGdaMjkwSUgwcE93b2dJQ0FnWld4elpTQnZkbVZ5Y0dGcFpDNXdkWE5vS0hzZ2FXUTZJR2x1ZGk1cFpDd2daWGhqWlhOek9pQm5iM1FnTFNCcGJuWXVZMlZ1ZEhNZ2ZTazdDaUFnZlFvZ0lISmxkSFZ5YmlCN0lHMWhkR05vWldRc0lIVnVjR0ZwWkN3Z2IzWmxjbkJoYVdRZ2ZUc0tmUXB0YjJSMWJHVXVaWGh3YjNKMGN5QTlJSHNnY21WamIyNWphV3hsSUgwN0NncXRCUW9SY21WamIyNWphV3hsTG5SbGMzUXVhbk1TbHdWamIyNXpkQ0JoYzNObGNuUWdQU0J5WlhGMWFYSmxLQ0p1YjJSbE9tRnpjMlZ5ZEM5emRISnBZM1FpS1RzS1kyOXVjM1FnZXlCeVpXTnZibU5wYkdVZ2ZTQTlJSEpsY1hWcGNtVW9JaTR2Y21WamIyNWphV3hsTG1weklpazdDbU52Ym5OMElHbHVkbTlwWTJWeklEMGdXd29nSUhzZ2FXUTZJQ0pKVGxZdE1UQXdNU0lzSUdObGJuUnpPaUF4TWpVd01DQjlMQW9nSUhzZ2FXUTZJQ0pKVGxZdE1UQXdNaUlzSUdObGJuUnpPaUE0TURBd0lIMHNDaUFnZXlCcFpEb2dJa2xPVmkweE1EQXpJaXdnWTJWdWRITTZJRFF5TURBZ2ZTd0tYVHNLWTI5dWMzUWdjR0Y1YldWdWRITWdQU0JiQ2lBZ2V5QnBiblp2YVdObE9pQWlTVTVXTFRFd01ERWlMQ0JqWlc1MGN6b2dNVEkxTURBZ2ZTd0tJQ0I3SUdsdWRtOXBZMlU2SUNKSlRsWXRNVEF3TWlJc0lHTmxiblJ6T2lBMU1EQXdJSDBzQ2lBZ2V5QnBiblp2YVdObE9pQWlTVTVXTFRFd01ETWlMQ0JqWlc1MGN6b2dOREl3TUNCOUxBb2dJSHNnYVc1MmIybGpaVG9nSWtsT1ZpMHhNREF6SWl3Z1kyVnVkSE02SURNd01DQjlMQXBkT3dwamIyNXpkQ0J5SUQwZ2NtVmpiMjVqYVd4bEtHbHVkbTlwWTJWekxDQndZWGx0Wlc1MGN5azdDbUZ6YzJWeWRDNWtaV1Z3UlhGMVlXd29jaTV0WVhSamFHVmtMQ0JiSWtsT1ZpMHhNREF4SWwwcE93cGhjM05sY25RdVpHVmxjRVZ4ZFdGc0tISXVkVzV3WVdsa0xDQmJleUJwWkRvZ0lrbE9WaTB4TURBeUlpd2diM2RsWkRvZ016QXdNQ0I5WFNrN0NtRnpjMlZ5ZEM1a1pXVndSWEYxWVd3b2NpNXZkbVZ5Y0dGcFpDd2dXM3NnYVdRNklDSkpUbFl0TVRBd015SXNJR1Y0WTJWemN6b2dNekF3SUgxZEtUc0tZMjl1YzI5c1pTNXNiMmNvSW5KbFkyOXVZMmxzWlRvZ015QmhjM05sY25ScGIyNXpJSEJoYzNObFpDSXBPd29Lb1FRS0IyMWhhVzR1YW5NU2xRUmpiMjV6ZENCN0lISmxZMjl1WTJsc1pTQjlJRDBnY21WeGRXbHlaU2dpTGk5eVpXTnZibU5wYkdVdWFuTWlLVHNLWTI5dWMzUWdhVzUyYjJsalpYTWdQU0JiQ2lBZ2V5QnBaRG9nSWtsT1ZpMHlNREF4SWl3Z1kyVnVkSE02SURrNU1EQXdJSDBzQ2lBZ2V5QnBaRG9nSWtsT1ZpMHlNREF5SWl3Z1kyVnVkSE02SURFMU1EQXdJSDBzQ2lBZ2V5QnBaRG9nSWtsT1ZpMHlNREF6SWl3Z1kyVnVkSE02SURjeU5UQWdmU3dLSUNCN0lHbGtPaUFpU1U1V0xUSXdNRFFpTENCalpXNTBjem9nTXpFd01EQWdmU3dLWFRzS1kyOXVjM1FnY0dGNWJXVnVkSE1nUFNCYkNpQWdleUJwYm5admFXTmxPaUFpU1U1V0xUSXdNREVpTENCalpXNTBjem9nT1Rrd01EQWdmU3dLSUNCN0lHbHVkbTlwWTJVNklDSkpUbFl0TWpBd01pSXNJR05sYm5Sek9pQXhOVEF3TUNCOUxBb2dJSHNnYVc1MmIybGpaVG9nSWtsT1ZpMHlNREEwSWl3Z1kyVnVkSE02SURNeE1EQXdJSDBzQ2lBZ2V5QnBiblp2YVdObE9pQWlTVTVXTFRJd01EUWlMQ0JqWlc1MGN6b2dNVEF3TUNCOUxBcGRPd3BqYjI1emRDQnlJRDBnY21WamIyNWphV3hsS0dsdWRtOXBZMlZ6TENCd1lYbHRaVzUwY3lrN0NtTnZibk52YkdVdWJHOW5LRXBUVDA0dWMzUnlhVzVuYVdaNUtIc2dhVzUyYjJsalpYTTZJR2x1ZG05cFkyVnpMbXhsYm1kMGFDd2djR0Y1YldWdWRITTZJSEJoZVcxbGJuUnpMbXhsYm1kMGFDd2dMaTR1Y2lCOUtTazdDaElXYm05a1pTQnlaV052Ym1OcGJHVXVkR1Z6ZEM1cWN4SU1ibTlrWlNCdFlXbHVMbXB6IiwicmVzcG9uc2UiOiJDZ3RrYjJOclpYSmpiRzkxWkJJQ2RtMFk2U0Vpd2dJSUJCSkFNREJqT1RWaVpUUTBNMlF6TlRnNU5EbGtNVEl6WkRjM05EWTBaVGxqTkRCaU1ETmtZV1prTTJZek1EazBZamN3T1dRNE56RTVZakF3TkdNd1lUZGhOQnBBTjJFek9HTTFNR1psTlRBd1lqVTRNamMzTnpSbVl6WTRNelV5WTJNMk5tRXhOVE5tTkRSbE9EbGxOMkUzWmpaa05qazJOV1kxT0RJellXUTBNRFJrT1NJTFpHOWphMlZ5WTJ4dmRXUXFBblp0TWxsa2IyTnJaWEpqYkc5MVpDMXBiV0ZuWlRwemFHRXlOVFk2TW1NM05USXlNalprTkRjM1lqUmhPRGcyTXpjNFltRmhPVFZpT1dGbU1qVXlZbVUxT1RNd01XSTNNalZtWkdJd1lqZGxNVFV5TURneE16RTFNRFZoT0VEMnRMTFRsalJJNE5heTA1WTBha0JpWWpZMVlUQTVNbUU0T1dWbE9HVTFNalEwTUdKbE5tUTFOekF5T0dWaVkyUmxZakkxWWpVNFpEazVNRE5tTVdaaVltWXhZbVV4T1RrM09USmhOelZqTWxsa2IyTnJaWEpqYkc5MVpDMXBiV0ZuWlRwemFHRXlOVFk2TW1NM05USXlNalprTkRjM1lqUmhPRGcyTXpjNFltRmhPVFZpT1dGbU1qVXlZbVUxT1RNd01XSTNNalZtWkdJd1lqZGxNVFV5TURneE16RTFNRFZoT0ZyckFRbzhDaFp1YjJSbElISmxZMjl1WTJsc1pTNTBaWE4wTG1wekVoOXlaV052Ym1OcGJHVTZJRE1nWVhOelpYSjBhVzl1Y3lCd1lYTnpaV1FLTU9RQ0NxZ0JDZ3h1YjJSbElHMWhhVzR1YW5NU2xBRjdJbWx1ZG05cFkyVnpJam8wTENKd1lYbHRaVzUwY3lJNk5Dd2liV0YwWTJobFpDSTZXeUpKVGxZdE1qQXdNU0lzSWtsT1ZpMHlNREF5SWwwc0luVnVjR0ZwWkNJNlczc2lhV1FpT2lKSlRsWXRNakF3TXlJc0ltOTNaV1FpT2pjeU5UQjlYU3dpYjNabGNuQmhhV1FpT2x0N0ltbGtJam9pU1U1V0xUSXdNRFFpTENKbGVHTmxjM01pT2pFd01EQjlYWDBLTVBrREdBRT0iLCJlbnZlbG9wZSI6eyJwYXlsb2FkVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5pbi10b3RvK2pzb24iLCJwYXlsb2FkIjoiZXlKZmRIbHdaU0k2SW1oMGRIQnpPaTh2YVc0dGRHOTBieTVwYnk5VGRHRjBaVzFsYm5RdmRqRWlMQ0p6ZFdKcVpXTjBJanBiZXlKdVlXMWxJam9pY25WdUxYSmxZMjl5WkNJc0ltUnBaMlZ6ZENJNmV5SnphR0V5TlRZaU9pSmlZalkxWVRBNU1tRTRPV1ZsT0dVMU1qUTBNR0psTm1RMU56QXlPR1ZpWTJSbFlqSTFZalU0WkRrNU1ETm1NV1ppWW1ZeFltVXhPVGszT1RKaE56VmpJbjE5WFN3aWNISmxaR2xqWVhSbFZIbHdaU0k2SW1oMGRIQnpPaTh2Y0d4cGJYTnZiR3h0WVhKckxtZHBkR2gxWWk1cGJ5OXdiR2x0YzI5c2JDOXlkVzR0Y21WamIzSmtMM1l4SWl3aWNISmxaR2xqWVhSbElqcDdJblpsY25OcGIyNGlPalFzSW5KbGNYVmxjM1JmYzJoaE1qVTJJam9pTURCak9UVmlaVFEwTTJRek5UZzVORGxrTVRJelpEYzNORFkwWlRsak5EQmlNRE5rWVdaa00yWXpNRGswWWpjd09XUTROekU1WWpBd05HTXdZVGRoTkNJc0luSmxjM1ZzZEY5emFHRXlOVFlpT2lJM1lUTTRZelV3Wm1VMU1EQmlOVGd5TnpjM05HWmpOamd6TlRKall6WTJZVEUxTTJZME5HVTRPV1UzWVRkbU5tUTJPVFkxWmpVNE1qTmhaRFF3TkdRNUlpd2ljSEp2ZG1sa1pYSWlPaUprYjJOclpYSmpiRzkxWkNJc0ltbHpiMnhoZEdsdmJpSTZJblp0SWl3aVpXNTJhWEp2Ym0xbGJuUWlPaUprYjJOclpYSmpiRzkxWkMxcGJXRm5aVHB6YUdFeU5UWTZNbU0zTlRJeU1qWmtORGMzWWpSaE9EZzJNemM0WW1GaE9UVmlPV0ZtTWpVeVltVTFPVE13TVdJM01qVm1aR0l3WWpkbE1UVXlNRGd4TXpFMU1EVmhPQ0lzSW5CdmJHbGplU0k2SWlJc0luTjBZWEowWldSZmRXNXBlRjl0Y3lJNk1UYzVNamM0TmpnMk5EYzFPQ3dpWlc1a1pXUmZkVzVwZUY5dGN5STZNVGM1TWpjNE5qZzJPVEE0T0N3aWMyVnpjMmx2YmlJNklpSXNJbk5sY1hWbGJtTmxJam93TENKd2NtVjJhVzkxYzE5emFHRXlOVFlpT2lJaUxDSnlaV052Y21SZmMyaGhNalUySWpvaVltSTJOV0V3T1RKaE9EbGxaVGhsTlRJME5EQmlaVFprTlRjd01qaGxZbU5rWldJeU5XSTFPR1E1T1RBelpqRm1ZbUptTVdKbE1UazVOemt5WVRjMVl5SjlmUT09Iiwic2lnbmF0dXJlcyI6W3sia2V5aWQiOiI4OGQzMTFmYjk0MmUwZmQ4N2NkYjEyMTRiMzg1ZGI1ZmMzNTRjMTY2ZTg0NzYzZjZkMzc4ODVkYmM5NmRmMzc5Iiwic2lnIjoiMFFHQWtFSlMyWkg3VWVoc25uaFNVNHBrb3liSWJaQlNmdmxkWWNOaG9yOUVPeDduRXVsbDB5OEg0dnFkSHg5MEhITXhITkxXSVhoWnc5eUVFMG85QWc9PSJ9XX0sImxpbmsiOnsicGF5bG9hZFR5cGUiOiJhcHBsaWNhdGlvbi92bmQuaW4tdG90bytqc29uIiwicGF5bG9hZCI6ImV5SmZkSGx3WlNJNkltaDBkSEJ6T2k4dmFXNHRkRzkwYnk1cGJ5OVRkR0YwWlcxbGJuUXZkakVpTENKemRXSnFaV04wSWpwYmV5SnVZVzFsSWpvaVluVnVaR3hsTFd4cGJtVWlMQ0prYVdkbGMzUWlPbnNpYzJoaE1qVTJJam9pT0dJMlkySXpZV1F5WkdKa09HWTNZV1UzTjJRd05Ua3paREZpTkdVNE1UZGxZVEJrWm1NMU1URmpaVFkwT0RWak1EUmxPREZoWmpBeU5EUTBPV1ZrWWlKOWZWMHNJbkJ5WldScFkyRjBaVlI1Y0dVaU9pSm9kSFJ3Y3pvdkwzQnNhVzF6YjJ4c2JXRnlheTVuYVhSb2RXSXVhVzh2Y0d4cGJYTnZiR3d2WW5WdVpHeGxMV3hwYm1zdmRqRWlMQ0p3Y21Wa2FXTmhkR1VpT25zaWFXNWtaWGdpT2pVc0luQnlaWFpwYjNWelgzTm9ZVEkxTmlJNklqZzJaVFl3WW1ZNE5tUTRNVFZtTm1Kak1tSTFaamt4WmpjMk4yRTJZV0UzTUROaE0yVm1ZVFkwTURneU56SXdPRGRqT1RjeU1qZzROekV6WkdGaFlUSWlMQ0psYm5SeWVWOXphR0V5TlRZaU9pSTRZalpqWWpOaFpESmtZbVE0WmpkaFpUYzNaREExT1ROa01XSTBaVGd4TjJWaE1HUm1ZelV4TVdObE5qUTROV013TkdVNE1XRm1NREkwTkRRNVpXUmlJbjE5Iiwic2lnbmF0dXJlcyI6W3sia2V5aWQiOiI4OGQzMTFmYjk0MmUwZmQ4N2NkYjEyMTRiMzg1ZGI1ZmMzNTRjMTY2ZTg0NzYzZjZkMzc4ODVkYmM5NmRmMzc5Iiwic2lnIjoicXk5cGhkTTFoSkI3VjdmSDBSOTYwanNiVTU2VWExYjFyTUVESzJhVTFTQ1ZMU3NRWm9qRGN1SDRYcGpGeUNXVEkvV2VhNVByMk5uOThodWZmZVR0QUE9PSJ9XX19", "contentType": "application/json", "encoding": "base64" } }, "name": "entry.json" }, { "contents": { "attachment": { "content": "eyJyZXF1ZXN0Ijp7Im1pbmltdW1faXNvbGF0aW9uIjoia2VybmVsIiwicHJvamVjdCI6eyJhcnRpZmFjdHMiOltdLCJmaWxlcyI6W3siY29udGVudCI6Ii8vIHJlY29uY2lsZS5qczogbWF0Y2ggcGF5bWVudHMgdG8gaW52b2ljZXMgYnkgaW52b2ljZSBpZCBhbmQgcmVwb3J0IHdoYXQgaXNcbi8vIHVucGFpZCwgb3ZlcnBhaWQgb3IgbWF0Y2hlZC4gQW1vdW50cyBhcmUgaW50ZWdlciBjZW50cy5cbmZ1bmN0aW9uIHJlY29uY2lsZShpbnZvaWNlcywgcGF5bWVudHMpIHtcbiAgY29uc3QgcGFpZCA9IG5ldyBNYXAoKTtcbiAgZm9yIChjb25zdCBwIG9mIHBheW1lbnRzKSBwYWlkLnNldChwLmludm9pY2UsIChwYWlkLmdldChwLmludm9pY2UpIHx8IDApICsgcC5jZW50cyk7XG4gIGNvbnN0IG1hdGNoZWQgPSBbXSwgdW5wYWlkID0gW10sIG92ZXJwYWlkID0gW107XG4gIGZvciAoY29uc3QgaW52IG9mIGludm9pY2VzKSB7XG4gICAgY29uc3QgZ290ID0gcGFpZC5nZXQoaW52LmlkKSB8fCAwO1xuICAgIGlmIChnb3QgPT09IGludi5jZW50cykgbWF0Y2hlZC5wdXNoKGludi5pZCk7XG4gICAgZWxzZSBpZiAoZ290IFx1MDAzYyBpbnYuY2VudHMpIHVucGFpZC5wdXNoKHsgaWQ6IGludi5pZCwgb3dlZDogaW52LmNlbnRzIC0gZ290IH0pO1xuICAgIGVsc2Ugb3ZlcnBhaWQucHVzaCh7IGlkOiBpbnYuaWQsIGV4Y2VzczogZ290IC0gaW52LmNlbnRzIH0pO1xuICB9XG4gIHJldHVybiB7IG1hdGNoZWQsIHVucGFpZCwgb3ZlcnBhaWQgfTtcbn1cbm1vZHVsZS5leHBvcnRzID0geyByZWNvbmNpbGUgfTtcbiIsInBhdGgiOiJyZWNvbmNpbGUuanMifSx7ImNvbnRlbnQiOiJjb25zdCBhc3NlcnQgPSByZXF1aXJlKFwibm9kZTphc3NlcnQvc3RyaWN0XCIpO1xuY29uc3QgeyByZWNvbmNpbGUgfSA9IHJlcXVpcmUoXCIuL3JlY29uY2lsZS5qc1wiKTtcbmNvbnN0IGludm9pY2VzID0gW1xuICB7IGlkOiBcIklOVi0xMDAxXCIsIGNlbnRzOiAxMjUwMCB9LFxuICB7IGlkOiBcIklOVi0xMDAyXCIsIGNlbnRzOiA4MDAwIH0sXG4gIHsgaWQ6IFwiSU5WLTEwMDNcIiwgY2VudHM6IDQyMDAgfSxcbl07XG5jb25zdCBwYXltZW50cyA9IFtcbiAgeyBpbnZvaWNlOiBcIklOVi0xMDAxXCIsIGNlbnRzOiAxMjUwMCB9LFxuICB7IGludm9pY2U6IFwiSU5WLTEwMDJcIiwgY2VudHM6IDUwMDAgfSxcbiAgeyBpbnZvaWNlOiBcIklOVi0xMDAzXCIsIGNlbnRzOiA0MjAwIH0sXG4gIHsgaW52b2ljZTogXCJJTlYtMTAwM1wiLCBjZW50czogMzAwIH0sXG5dO1xuY29uc3QgciA9IHJlY29uY2lsZShpbnZvaWNlcywgcGF5bWVudHMpO1xuYXNzZXJ0LmRlZXBFcXVhbChyLm1hdGNoZWQsIFtcIklOVi0xMDAxXCJdKTtcbmFzc2VydC5kZWVwRXF1YWwoci51bnBhaWQsIFt7IGlkOiBcIklOVi0xMDAyXCIsIG93ZWQ6IDMwMDAgfV0pO1xuYXNzZXJ0LmRlZXBFcXVhbChyLm92ZXJwYWlkLCBbeyBpZDogXCJJTlYtMTAwM1wiLCBleGNlc3M6IDMwMCB9XSk7XG5jb25zb2xlLmxvZyhcInJlY29uY2lsZTogMyBhc3NlcnRpb25zIHBhc3NlZFwiKTtcbiIsInBhdGgiOiJyZWNvbmNpbGUudGVzdC5qcyJ9LHsiY29udGVudCI6ImNvbnN0IHsgcmVjb25jaWxlIH0gPSByZXF1aXJlKFwiLi9yZWNvbmNpbGUuanNcIik7XG5jb25zdCBpbnZvaWNlcyA9IFtcbiAgeyBpZDogXCJJTlYtMjAwMVwiLCBjZW50czogOTkwMDAgfSxcbiAgeyBpZDogXCJJTlYtMjAwMlwiLCBjZW50czogMTUwMDAgfSxcbiAgeyBpZDogXCJJTlYtMjAwM1wiLCBjZW50czogNzI1MCB9LFxuICB7IGlkOiBcIklOVi0yMDA0XCIsIGNlbnRzOiAzMTAwMCB9LFxuXTtcbmNvbnN0IHBheW1lbnRzID0gW1xuICB7IGludm9pY2U6IFwiSU5WLTIwMDFcIiwgY2VudHM6IDk5MDAwIH0sXG4gIHsgaW52b2ljZTogXCJJTlYtMjAwMlwiLCBjZW50czogMTUwMDAgfSxcbiAgeyBpbnZvaWNlOiBcIklOVi0yMDA0XCIsIGNlbnRzOiAzMTAwMCB9LFxuICB7IGludm9pY2U6IFwiSU5WLTIwMDRcIiwgY2VudHM6IDEwMDAgfSxcbl07XG5jb25zdCByID0gcmVjb25jaWxlKGludm9pY2VzLCBwYXltZW50cyk7XG5jb25zb2xlLmxvZyhKU09OLnN0cmluZ2lmeSh7IGludm9pY2VzOiBpbnZvaWNlcy5sZW5ndGgsIHBheW1lbnRzOiBwYXltZW50cy5sZW5ndGgsIC4uLnIgfSkpO1xuIiwicGF0aCI6Im1haW4uanMifV0sImdyYW50X3Byb2ZpbGUiOiIiLCJzdGVwcyI6WyJub2RlIHJlY29uY2lsZS50ZXN0LmpzIiwibm9kZSBtYWluLmpzIl19LCJwcm90b2NvbCI6NCwic29mdHdhcmVfcnVsZSI6bnVsbCwidGltZW91dF9tcyI6MzAwMDAsInRyYWNlX2lkIjoibWFuaWZlc3QtcG9jLXJ1bi0xIn0sInJlc3BvbnNlIjp7ImR1cmF0aW9uX21zIjoiNDMyOSIsImVudmlyb25tZW50IjoiZG9ja2VyY2xvdWQtaW1hZ2U6c2hhMjU2OjJjNzUyMjI2ZDQ3N2I0YTg4NjM3OGJhYTk1YjlhZjI1MmJlNTkzMDFiNzI1ZmRiMGI3ZTE1MjA4MTMxNTA1YTgiLCJpbnN0YW5jZSI6IiIsImlzb2xhdGlvbiI6InZtIiwicHJvamVjdCI6eyJhZHZpY2UiOltdLCJhcnRpZmFjdHMiOltdLCJhcnRpZmFjdHNfdHJ1bmNhdGVkIjpmYWxzZSwib3V0Y29tZSI6IlBST0pFQ1RfT1VUQ09NRV9DT01QTEVURUQiLCJvdXRjb21lX2RldGFpbCI6IiIsInN0ZXBzIjpbeyJjb21tYW5kIjoibm9kZSByZWNvbmNpbGUudGVzdC5qcyIsImR1cmF0aW9uX21zIjoiMzU2IiwiZXhpdF9jb2RlIjowLCJzdGRlcnIiOiIiLCJzdGRlcnJfdHJ1bmNhdGVkIjpmYWxzZSwic3Rkb3V0IjoiY21WamIyNWphV3hsT2lBeklHRnpjMlZ5ZEdsdmJuTWdjR0Z6YzJWa0NnPT0iLCJzdGRvdXRfdHJ1bmNhdGVkIjpmYWxzZSwidGltZWRfb3V0IjpmYWxzZX0seyJjb21tYW5kIjoibm9kZSBtYWluLmpzIiwiZHVyYXRpb25fbXMiOiI1MDUiLCJleGl0X2NvZGUiOjAsInN0ZGVyciI6IiIsInN0ZGVycl90cnVuY2F0ZWQiOmZhbHNlLCJzdGRvdXQiOiJleUpwYm5admFXTmxjeUk2TkN3aWNHRjViV1Z1ZEhNaU9qUXNJbTFoZEdOb1pXUWlPbHNpU1U1V0xUSXdNREVpTENKSlRsWXRNakF3TWlKZExDSjFibkJoYVdRaU9sdDdJbWxrSWpvaVNVNVdMVEl3TURNaUxDSnZkMlZrSWpvM01qVXdmVjBzSW05MlpYSndZV2xrSWpwYmV5SnBaQ0k2SWtsT1ZpMHlNREEwSWl3aVpYaGpaWE56SWpveE1EQXdmVjE5Q2c9PSIsInN0ZG91dF90cnVuY2F0ZWQiOmZhbHNlLCJ0aW1lZF9vdXQiOmZhbHNlfV19LCJyZWNvcmQiOnsiZW5kZWRfdW5peF9tcyI6IjE3OTI3ODY4NjkwODgiLCJlbnZpcm9ubWVudCI6ImRvY2tlcmNsb3VkLWltYWdlOnNoYTI1NjoyYzc1MjIyNmQ0NzdiNGE4ODYzNzhiYWE5NWI5YWYyNTJiZTU5MzAxYjcyNWZkYjBiN2UxNTIwODEzMTUwNWE4IiwiaW5zdGFuY2UiOiIiLCJpc29sYXRpb24iOiJ2bSIsInBvbGljeSI6IiIsInByZXZpb3VzX3NoYTI1NiI6IiIsInByb3ZpZGVyIjoiZG9ja2VyY2xvdWQiLCJyZWNvcmRfc2hhMjU2IjoiYmI2NWEwOTJhODllZThlNTI0NDBiZTZkNTcwMjhlYmNkZWIyNWI1OGQ5OTAzZjFmYmJmMWJlMTk5NzkyYTc1YyIsInJlcXVlc3Rfc2hhMjU2IjoiMDBjOTViZTQ0M2QzNTg5NDlkMTIzZDc3NDY0ZTljNDBiMDNkYWZkM2YzMDk0YjcwOWQ4NzE5YjAwNGMwYTdhNCIsInJlc3VsdF9zaGEyNTYiOiI3YTM4YzUwZmU1MDBiNTgyNzc3NGZjNjgzNTJjYzY2YTE1M2Y0NGU4OWU3YTdmNmQ2OTY1ZjU4MjNhZDQwNGQ5Iiwic2VxdWVuY2UiOiIwIiwic2Vzc2lvbiI6IiIsInNvZnR3YXJlX2lkZW50aXR5IjoiIiwic29mdHdhcmVfcnVsZV9pZCI6IiIsInN0YXJ0ZWRfdW5peF9tcyI6IjE3OTI3ODY4NjQ3NTgiLCJ1bmFuc3dlcmVkIjoiIiwidmVyc2lvbiI6NH0sInNhbmRib3giOiJkb2NrZXJjbG91ZCIsInNvZnR3YXJlX2lkZW50aXR5IjoiIn19", "contentType": "application/json", "encoding": "base64" } }, "name": "exchange.json" } ], "description": "Public example evidence: DSSE envelope, signed body type application/vnd.in-toto+json, in-toto statement https://in-toto.io/Statement/v1, predicate https://plimsollmark.github.io/plimsoll/run-record/v1, key id 88d311fb942e0fd87cdb1214b385db5fc354c166e84763f6d37885dbc96df379. entry.json is line 5 of the referenced bundle as stored: the exact binary protobuf request and response, the record's envelope and the harness's signed link placing the line. exchange.json is a plain JSON copy checked against those bytes.", "propertyName": "plimsoll:run_record" } ] }, "definitions": { "standards": [ { "bom-ref": "std-plimsoll-run-evidence", "name": "plimsoll run evidence", "requirements": [ { "bom-ref": "req-code", "identifier": "R1", "title": "the code that ran is identified by digest" }, { "bom-ref": "req-image", "identifier": "R2", "title": "the image is identified by its manifest digest" }, { "bom-ref": "req-tier", "identifier": "R3", "title": "the isolation tier the daemon states is signed" } ], "version": "1" } ] }, "formulation": [ { "bom-ref": "formula", "workflows": [ { "bom-ref": "run", "inputs": [ { "resource": { "ref": "program" } } ], "name": "plimsoll run", "outputs": [ { "properties": [ { "name": "plimsoll:result_sha256", "value": "7a38c50fe500b5827774fc68352cc66a153f44e89e7a7f6d6965f5823ad404d9" } ], "resource": { "ref": "evidence-run-record" }, "type": "other" } ], "properties": [ { "name": "plimsoll:provider", "value": "dockercloud" }, { "name": "plimsoll:isolation", "value": "vm" }, { "name": "plimsoll:minimum_isolation", "value": "kernel" }, { "name": "plimsoll:timeout_ms", "value": "30000" }, { "name": "plimsoll:grant", "value": "none" }, { "name": "plimsoll:outcome", "value": "completed" } ], "runtimeTopology": [ { "dependsOn": [ "image" ], "ref": "program" } ], "taskDependencies": [ { "ref": "step-1" }, { "dependsOn": [ "step-1" ], "ref": "step-2" } ], "taskTypes": [ "other" ], "tasks": [ { "bom-ref": "step-1", "name": "node reconcile.test.js", "steps": [ { "commands": [ { "executed": "node reconcile.test.js", "properties": [ { "name": "plimsoll:exit_code", "value": "0" }, { "name": "plimsoll:duration_ms", "value": "356" }, { "name": "plimsoll:timed_out", "value": "false" }, { "name": "plimsoll:stdout_truncated", "value": "false" }, { "name": "plimsoll:stderr_truncated", "value": "false" } ] } ] } ], "taskTypes": [ "other" ], "uid": "1" }, { "bom-ref": "step-2", "name": "node main.js", "steps": [ { "commands": [ { "executed": "node main.js", "properties": [ { "name": "plimsoll:exit_code", "value": "0" }, { "name": "plimsoll:duration_ms", "value": "505" }, { "name": "plimsoll:timed_out", "value": "false" }, { "name": "plimsoll:stdout_truncated", "value": "false" }, { "name": "plimsoll:stderr_truncated", "value": "false" } ] } ] } ], "taskTypes": [ "other" ], "uid": "2" } ], "timeEnd": "2026-10-23T20:21:09.088Z", "timeStart": "2026-10-23T20:21:04.758Z", "uid": "bb65a092a89ee8e52440be6d57028ebcdeb25b58d9903f1fbbf1be199792a75c" } ] } ], "metadata": { "component": { "bom-ref": "program", "components": [ { "hashes": [ { "alg": "SHA-256", "content": "71ef6972211c39f941bfac9534cefd7b19cff470419f148a7351743d011b7698" } ], "name": "main.js", "properties": [ { "name": "plimsoll:bytes", "value": "533" } ], "type": "file" }, { "hashes": [ { "alg": "SHA-256", "content": "c2de8205ca1e811fba188b71b051e25644f88b8190351372ab3ed4a842231456" } ], "name": "reconcile.js", "properties": [ { "name": "plimsoll:bytes", "value": "685" } ], "type": "file" }, { "hashes": [ { "alg": "SHA-256", "content": "ce76efdec6de19969e12f5ca27b273396ca274dfa330df36811f78354c659c97" } ], "name": "reconcile.test.js", "properties": [ { "name": "plimsoll:bytes", "value": "663" } ], "type": "file" } ], "description": "An agent-style example program run once through plimsoll; authorship is supplied context, not verified evidence.", "externalReferences": [ { "hashes": [ { "alg": "SHA-256", "content": "3f7028e3e5d367770ac721306548d7d741a9eeb284f8bbd4441320f76076e772" } ], "type": "attestation", "url": "https://plimsollmark.github.io/plimsoll/examples/sbom/bundle.jsonl" }, { "type": "documentation", "url": "https://plimsollmark.github.io/plimsoll/examples/sbom/index.html" }, { "type": "vcs", "url": "https://github.com/plimsollmark/plimsoll" } ], "hashes": [ { "alg": "SHA-256", "content": "6bc21d24ac7a0e21fa02e023551a11d0e3d8ce8310039c4b3c6765609f9c14d8" } ], "name": "reconcile", "properties": [ { "name": "plimsoll:author_kind", "value": "agent" }, { "name": "plimsoll:author_kind_basis", "value": "supplied example context, unverified" }, { "name": "plimsoll:request_sha256", "value": "00c95be443d358949d123d77464e9c40b03dafd3f3094b709d8719b004c0a7a4" }, { "name": "plimsoll:result_sha256", "value": "7a38c50fe500b5827774fc68352cc66a153f44e89e7a7f6d6965f5823ad404d9" }, { "name": "plimsoll:record_sha256", "value": "bb65a092a89ee8e52440be6d57028ebcdeb25b58d9903f1fbbf1be199792a75c" }, { "name": "plimsoll:trace_id", "value": "manifest-poc-run-1" } ], "type": "application", "version": "6bc21d24ac7a" }, "lifecycles": [ { "phase": "operations" } ], "timestamp": "2026-10-23T20:21:09.088Z", "tools": { "components": [ { "externalReferences": [ { "type": "vcs", "url": "https://github.com/plimsollmark/plimsoll" } ], "name": "plimsoll-sbom", "type": "application", "version": "0.2.0" } ] } }, "properties": [ { "name": "plimsoll:bundle_sha256", "value": "3f7028e3e5d367770ac721306548d7d741a9eeb284f8bbd4441320f76076e772" }, { "name": "plimsoll:bundle_line", "value": "5" }, { "name": "plimsoll:emitter", "value": "examples/sbom" } ], "serialNumber": "urn:uuid:70cb4b1d-d7e7-4dc6-aeac-ef581729698d", "specVersion": "1.6", "version": 1 }