{
 "_type": "https://in-toto.io/Statement/v1",
 "subject": [
  {
   "name": "corecp-lsphp-e2e1790741130_1.0.0_amd64.deb",
   "digest": {
    "sha512": "0fd0a99f3fdebdc7c2babe8bb88e226e803c1f96f4681d465420f9f0a59dcc7b3765bede7e97d8cb4c0057b4a46794d0f4dbd058d3e98d482cfa38d941e2e2a7",
    "sha256": "1df4681ec10f0d3cb0b5dbe27ade13bc9f517eb6c6d77561bdc6286eba15ea41"
   }
  }
 ],
 "predicateType": "https://slsa.dev/provenance/v1",
 "predicate": {
  "buildDefinition": {
   "buildType": "https://corecp.dev/build/deb/v1",
   "externalParameters": {
    "package": "corecp-lsphp-e2e1790741130",
    "version": "1.0.0",
    "architecture": "amd64",
    "buildScript": "unknown",
    "sourceCommit": null,
    "sourceCommitNote": "unknown: this build ran from a source tree with no git history (the build server holds an rsync copy), and no caller passed CORECP_SOURCE_COMMIT"
   },
   "internalParameters": {
    "toolchain": {
     "go": "go version go1.26.6 linux/amd64",
     "dpkg-deb": "Debian 'dpkg-deb' package archive backend version 1.23.7 (amd64).",
     "node": "v22.22.1"
    }
   },
   "resolvedDependencies": []
  },
  "runDetails": {
   "builder": {
    "id": "https://build.corecp.dev/corecp-build",
    "builderDependencies": []
   },
   "metadata": {
    "invocationId": "corecp-lsphp-e2e1790741130-1.0.0-1df4681ec10f0d3c",
    "startedOn": "2026-09-30T04:09:30Z",
    "finishedOn": "2026-09-30T04:09:30Z"
   }
  }
 },
 "_note": "SLSA Build L1 with a signed statement. This document is produced by the build script itself and signed with the release key, which lives on the same machine that builds and serves the packages (docs/build-infra.md). That is enough to say what went into an artifact and to detect a change to this statement after the fact. It is not L2 or L3: the build is not run by an isolated service, nothing here attests that the source tree was unmodified, and the builder could produce a false statement about its own output. Read it as a manifest of intent that is hard to edit, not as a proof of an untampered build."
}