{
 "_type": "https://in-toto.io/Statement/v1",
 "subject": [
  {
   "name": "corecp-pebble_2.10.1+corecp2_amd64.deb",
   "digest": {
    "sha512": "3813a3bede88e8f2589357380254b2ea1feaa5339222c0f42a9040a730dfaf1f0131ec22691c86842ccdb343b06bbf1c2adbb68e70f2e91a39a5730ef18623bd",
    "sha256": "7494c2de157d944d7673ca3ac0571695640d6661e7bfc7bfc3d6bff4f3411c03"
   }
  }
 ],
 "predicateType": "https://slsa.dev/provenance/v1",
 "predicate": {
  "buildDefinition": {
   "buildType": "https://corecp.dev/build/sbuild/v1",
   "externalParameters": {
    "package": "corecp-pebble",
    "version": "2.10.1+corecp2",
    "architecture": "amd64",
    "buildScript": "infra/build-server/sbuild/recipes/pebble.sh",
    "sourceCommit": "b2dd8b8d780f3b973050222ceb7054ab8b8c68c3",
    "recipe": "pebble"
   },
   "internalParameters": {
    "toolchain": {
     "binutils": "2.46-3ubuntu2",
     "dpkg-dev": "1.23.7ubuntu1",
     "g++-15": "15.2.0-16ubuntu1",
     "gcc-15": "15.2.0-16ubuntu1",
     "libc6-dev": "2.43-2ubuntu2.4",
     "make": "4.4.1-3"
    },
    "environment": {
     "mode": "sbuild-unshare",
     "network": "disabled during the build (sbuild enable_network=0)",
     "chrootTarballSha256": "83ed65faa9a093e4a8dbc8f95453aecfffc39fc4d19b626fdc737096eb0d6f78",
     "buildcache": {
      "state": "miss",
      "key": "5f48632e16ec9e33e4fbe0d674a10bf54a88b46f7cb5b7000d51649368429ccd"
     }
    }
   },
   "resolvedDependencies": [
    {
     "name": "inputs/pebble-linux-amd64.tar.gz",
     "uri": "https://github.com/letsencrypt/pebble/releases/download/v2.10.1/pebble-linux-amd64.tar.gz",
     "digest": {
      "sha256": "4f2fcb5bca8c85c9cf73ad140fccfc0d2be40bd81ab99879c79b7b8a0b4f70ed"
     },
     "annotations": {
      "verified": "sha256 pinned in packages/pebble/CHECKSUMS.sha256 (staged under /srv/corecp/vendor/pebble)"
     }
    },
    {
     "name": "inputs/pebble-challtestsrv-linux-amd64.tar.gz",
     "uri": "https://github.com/letsencrypt/pebble/releases/download/v2.10.1/pebble-challtestsrv-linux-amd64.tar.gz",
     "digest": {
      "sha256": "e93a5aa25ecdf3af2f9fbb2de32b0173e64a2eae81002a4ccfe35fa6f4f60b92"
     },
     "annotations": {
      "verified": "sha256 pinned in packages/pebble/CHECKSUMS.sha256 (staged under /srv/corecp/vendor/pebble)"
     }
    }
   ]
  },
  "runDetails": {
   "builder": {
    "id": "https://build.corecp.dev/corecp-build",
    "builderDependencies": [
     {
      "name": "resolute-amd64.tar.zst",
      "digest": {
       "sha256": "83ed65faa9a093e4a8dbc8f95453aecfffc39fc4d19b626fdc737096eb0d6f78"
      }
     },
     {
      "name": "corecp-pebble_2.10.1+corecp2_amd64.buildinfo",
      "digest": {
       "sha256": "2105138a81a6487981d51e42375cc04a4a8bb1291d7b6a6060daa016069ee249"
      },
      "annotations": {
       "installedBuildDepends": 115
      }
     }
    ]
   },
   "metadata": {
    "invocationId": "corecp-pebble-2.10.1+corecp2-7494c2de157d944d",
    "startedOn": "2026-09-14T08:30:23Z",
    "finishedOn": "2026-09-14T08:31:22Z"
   }
  }
 },
 "_note": "SLSA Build L1 with a signed statement. The artifact was built by sbuild in unshare mode: a fresh copy of a recorded Ubuntu chroot tarball, as an unprivileged user, with the network switched off while the build ran, from sources whose digests were verified before the build started. That makes the build repeatable and its inputs checkable. It is still not L2 or L3: the build runs on the machine that holds the release key, it is started by the same operator who signs, and nothing here attests that the recipe in the source tree was unmodified. Read it as an accurate record of what went in, made hard to edit afterwards — not as proof of an untampered build."
}