pacvamp-repo attest

• Usage: pacvamp-repo attest <FLAGS> <PACKAGES>…

Write a build provenance envelope beside each package

Every package file gets <file>.provenance.json: an in-toto statement with the SLSA v1 provenance predicate naming the pkgbase, the PKGBUILD source and commit, and every source artifact with its digest, signed with the build key in a DSSE envelope. The index marks a package as having build provenance when the envelope verifies with an accepted build key.

Arguments

• <PACKAGES>… — Package files to attest

Flags

• -k --key <KEY> — The build key (secret seed from packslip keygen)
• --pkgbase <PKGBASE> — The pkgbase that was built
• --source <SOURCE> — The PKGBUILD repository URL
• --commit <COMMIT> — The PKGBUILD commit that was built
• --dependency <DEPENDENCY> — A source artifact as uri=sha256, repeatable
• --invocation <INVOCATION> — An identifier for this build run; defaults to a timestamp
• --rekor <REKOR> — Upload each envelope to this transparency log and store the entry beside the package (https://rekor.sigstore.dev for the public log)
• -h --help — Print help