{
 "_type": "https://in-toto.io/Statement/v1",
 "subject": [
  {
   "name": "corecp-agent_0.39.0~e2e1788803550_amd64.deb",
   "digest": {
    "sha512": "84059b0701968c8236f09cb8d9de71e337c55df142f05a1d952a09966a23373a452e672a8d41f7e6875a7aba3be9e87bbc751f87ca5e70c080db0e67c64c9ddb",
    "sha256": "7143057a172318abbda4bf57b3252e1695101b7373b27e2e5e567949068493bd"
   }
  }
 ],
 "predicateType": "https://slsa.dev/provenance/v1",
 "predicate": {
  "buildDefinition": {
   "buildType": "https://corecp.dev/build/deb/v1",
   "externalParameters": {
    "package": "corecp-agent",
    "version": "0.39.0~e2e1788803550",
    "architecture": "amd64",
    "buildScript": "corectl/packaging/build-deb.sh",
    "sourceCommit": "7ff2670976b43f87fd7e2d48bf5590e4c36c0e57"
   },
   "internalParameters": {
    "toolchain": {
     "go": "go version go1.26.6 linux/amd64",
     "dpkg-deb": "Debian 'dpkg-deb' package archive backend version 1.23.7 (amd64).",
     "node": "v22.22.1"
    }
   },
   "resolvedDependencies": [
    {
     "uri": "file:///corectl/go.mod",
     "name": "corectl/go.mod",
     "digest": {
      "sha256": "3834798984095c14befd46f5cb51895c1e3096b4e26af2fa34b667456a832ea9"
     }
    },
    {
     "uri": "file:///corectl/go.sum",
     "name": "corectl/go.sum",
     "digest": {
      "sha256": "c740cef2b1321a7ea24040f29b9929866ad70b599ad835a8ce71ba77742b45b0"
     }
    },
    {
     "uri": "file:///supply-chain/inventory.json",
     "name": "supply-chain/inventory.json",
     "digest": {
      "sha256": "894c649505124e51ba677df6d53e952a42789bd9aeabce7a9d518f316babad35"
     }
    }
   ]
  },
  "runDetails": {
   "builder": {
    "id": "https://build.corecp.dev/corecp-build",
    "builderDependencies": []
   },
   "metadata": {
    "invocationId": "corecp-agent-0.39.0~e2e1788803550-7143057a172318ab",
    "startedOn": "2026-09-07T17:52:59Z",
    "finishedOn": "2026-09-07T17:52:59Z"
   }
  }
 },
 "_note": "SLSA Build L1 with a signed statement. This document is produced by the build script itself and signed with the release key, which lives on the same machine that builds and serves the packages (docs/build-infra.md). That is enough to say what went into an artifact and to detect a change to this statement after the fact. It is not L2 or L3: the build is not run by an isolated service, nothing here attests that the source tree was unmodified, and the builder could produce a false statement about its own output. Read it as a manifest of intent that is hard to edit, not as a proof of an untampered build."
}