security/release-evidence.example.json

{
  "artifacts": {
    "dependencyScan": {
      "path": "pip-audit.json",
      "sha256": "REPLACE_WITH_64_HEX",
      "status": "pass",
      "subject": "sha256:REPLACE_WITH_64_HEX",
      "tool": {
        "name": "pip-audit",
        "version": "REPLACE"
      }
    },
    "imageSbom": {
      "path": "image.cdx.json",
      "sha256": "REPLACE_WITH_64_HEX",
      "status": "pass",
      "subject": "sha256:REPLACE_WITH_64_HEX",
      "tool": {
        "name": "syft",
        "version": "REPLACE"
      }
    },
    "imageScan": {
      "path": "image-scan.json",
      "sha256": "REPLACE_WITH_64_HEX",
      "status": "pass",
      "subject": "sha256:REPLACE_WITH_64_HEX",
      "tool": {
        "name": "REPLACE",
        "version": "REPLACE"
      }
    },
    "provenance": {
      "path": "provenance.json",
      "predicateType": "https://slsa.dev/provenance/v1",
      "sha256": "REPLACE_WITH_64_HEX",
      "signatureVerified": true,
      "status": "pass",
      "subject": "sha256:REPLACE_WITH_64_HEX",
      "tool": {
        "name": "REPLACE",
        "version": "REPLACE"
      }
    },
    "signatureVerification": {
      "path": "signature-verification.json",
      "sha256": "REPLACE_WITH_64_HEX",
      "status": "pass",
      "subject": "sha256:REPLACE_WITH_64_HEX",
      "tool": {
        "name": "REPLACE",
        "version": "REPLACE"
      }
    }
  },
  "image": {
    "digest": "sha256:REPLACE_WITH_64_HEX",
    "platform": "linux/amd64"
  },
  "logging": {
    "apmBodyCapture": false,
    "authorizationHeaderLogging": false,
    "capabilityHeaderLogging": false,
    "queryStringLogging": false,
    "requestBodyLogging": false,
    "reviewedAt": "2099-01-01T00:00:00Z",
    "thirdPartyTelemetryExport": false,
    "wafBodyCapture": false
  },
  "redis": {
    "contribution": {
      "backupRestoreTestedAt": "2098-12-15T00:00:00Z",
      "leastPrivilegeReviewed": true,
      "nonDefaultIdentity": true,
      "persistenceVerified": true,
      "replicationVerified": true,
      "tlsVerified": true
    },
    "rateLimit": {
      "backupRestoreTestedAt": null,
      "leastPrivilegeReviewed": true,
      "nonDefaultIdentity": true,
      "persistenceVerified": false,
      "replicationVerified": false,
      "tlsVerified": true
    },
    "share": {
      "backupRestoreTestedAt": "2098-12-15T00:00:00Z",
      "leastPrivilegeReviewed": true,
      "nonDefaultIdentity": true,
      "persistenceVerified": true,
      "replicationVerified": true,
      "tlsVerified": true
    }
  },
  "release": {
    "expiresAt": "2099-01-02T00:00:00Z",
    "generatedAt": "2099-01-01T00:00:00Z",
    "proxyVersion": "7.0.0",
    "releaseId": "example-only-not-production",
    "targetPlatform": "linux/amd64"
  },
  "riskExceptions": [],
  "schemaVersion": 1,
  "source": {
    "baseImageIndexDigest": "sha256:REPLACE_WITH_64_HEX",
    "baseImageManifestDigest": "sha256:REPLACE_WITH_64_HEX",
    "pythonSbomSha256": "REPLACE_WITH_64_HEX",
    "requirementsLockSha256": "REPLACE_WITH_64_HEX",
    "runtimeSourceSha256": "REPLACE_WITH_64_HEX"
  }
}