Customizing the Provenance Document
sidebar_label: "Customizing Provenance" title: "Customizing the Provenance Document" sidebar_position: 5 toc_min_heading_level: 2 toc_max_heading_level: 5
Use the following flags to tailor the provenance document to your needs.
Include external by-products
Flag | Purpose | Example |
---|---|---|
--by-product <path> | Attach the contents of a file (e.g., log, SBOM) as a by-product | valint slsa busybox:latest --by-product /path/to/file.txt |
--components <list> | When the by-product is an SBOM, include finer-grained components such as layers , packages , or files (comma‑separated list) | valint slsa busybox:latest --components layers,packages,files |
Override key provenance fields
Flag | Field | Example |
---|---|---|
--invocation | Invocation ID | --invocation my_invocation |
--build-type | Build type | --build-type docker |
--builder-id | Builder ID | --builder-id 12345 |
--started-on | Build start time (RFC 3339) | --started-on 2023-07-25T15:30:00Z |
--finished-on | Build finish time (RFC 3339) | --finished-on 2023-07-25T16:00:00Z |
Full example
valint slsa busybox:latest \
--source git:https://github.com/my_org/my_repo.git \
--git-tag v1.0.0 \
--invocation my_invocation \
--build-type docker \
--builder-id 12345 \
--started-on 2023-07-25T15:30:00Z \
--finished-on 2023-07-25T16:00:00Z
Add extra evidence (by-product references)
Flag | Purpose |
---|---|
--source <git_url> | Generate an SBOM for the specified Git repository |
--bom | Generate an SBOM for the primary container‑image target |
--input <target> | Generate evidence for any additional target (extra Git repo, image, or third‑party tool output) |
valint bom \
--source https://github.com/your-org/your-repo.git \
--bom \
--input ghcr.io/your-org/extra-image:latest
Add environment variables
* --all-env
– Attach all environment variables to internalParameters
.
* --env <NAME>
– Attach a specific variable.
# Attach all environment variables
valint slsa busybox:latest --all-env
# Attach a single variable
valint slsa busybox:latest --env MY_ENV
Extend external parameters
* --external <key=value>
– Add key–value pairs to externalParameters
.
valint slsa busybox:latest --external my_custom_param=my_custom_value
Supply a custom predicate or statement
Flag | Purpose | Example |
---|---|---|
--predicate <file> | Merge a full or partial SLSA predicate | valint slsa busybox:latest --predicate custom.predicate.json |
--statement <file> | Merge a full or partial SLSA statement | valint slsa busybox:latest --statement custom.statement.json |
Predicate template (custom.predicate.json
)
{
"buildDefinition": {
"externalParameters": {
"custom_external": {
"name": "build-environment",
"value": "production",
"uri": "https://company.com/my_repo/event",
"digest": { "sha1": "910b17c3bc81ca8c791aaa394d508219e03879f8" }
}
}
},
"runDetails": {
"builder": {
"builderDependencies": [
{
"uri": "https://github.com/.github/reusable_build.yaml",
"name": "my_tool",
"annotations": { "vendor": "My company Inc", "version": "1.0" }
}
]
},
"metadata": {
"invocationID": "https://company.com/my_repo/build.sh",
"startedOn": "2023-07-25T15:30:00Z",
"finishedOn": "2023-07-25T16:00:00Z"
}
}
}
Statement template (custom.statement.json
)
{
"_type": "https://in-toto.io/Statement/v0.1",
"predicateType": "https://slsa.dev/provenance/v1",
"subject": [
{
"name": "index.docker.io/my_image",
"digest": {
"sha256": "62aedd01bd8520c43d06b09f7a0f67ba9720bdc04631a8242c65ea995f3ecac8"
}
}
],
"predicate": {
"runDetails": {
"byproducts": [
{
"uri": "pkg:docker/index.docker.io/my_image:latest@sha256:7ad00cd55506625f2afad262de6002c8cef20d214b353e51d1025e40e8646e18?index=0",
"digest": {
"sha256": "7ad00cd55506625f2afad262de6002c8cef20d214b353e51d1025e40e8646e18"
},
"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
"annotations": { "tag": "v0.0.1" }
}
]
}
}
}