What verify-artifact actually vouches for beyond identity and digest #899

Activity

1. basitalisandhu commented on Oct 20, 2026

   

   basitalisandhu

   on Oct 20, 2026

   More actions

   Mostly right, with one correction: verify-artifact does read the dependency list, but only its first entry, and only as the source.

   From main (4609978):

   • The source check is taken from that list. SourceURI() returns materials[0].uri for v0.2 (v0.2/base.go#L45-L55) and resolvedDependencies[0].uri for v1.0 (v1.0/base.go#L36-L47). verifySourceURI then requires it to match --source-uri, to carry a ref (apart from the npm pre-GA and BYOB exceptions), and to be equal to the trigger URI (invocation.configSource.uri in v0.2) (provenance.go#L106-L181). So materials[0] / resolvedDependencies[0] is what "this exact source ref" is read from.
   • Nothing after the first entry is read. In the repo's own testdata, 70 of 128 provenances have two entries (the Go builder's v0.2 provenance also lists the runner image, e.g. cli/slsa-verifier/testdata/binary-linux-amd64-sharded.intoto.jsonl), and the second one is never compared to anything.
   • For builders that are not on the trusted list (npm CLI provenance), verifyProvenanceMatchesCertificate also runs (provenance.go#L287-L291). It requires exactly one resolved dependency (provenance_forgeable.go#L107-L117) and checks the GitHub environment values in the provenance against the Fulcio certificate. Its comment says the material source is covered by the common checks, and v1.0 fields are still a TODO (Verify more fields for npm v1.0 provenance #566).
   • Nothing external is checked: the commit is not fetched, no digest in the list is compared to anything, and there is no check that the list is complete.

   So a pass means: a trusted builder (or, for npm, the certificate identity) vouches that this digest was built from this repo and ref. The source entry is checked, everything else in the list is the builder's own claim. You get the "nothing outside builder, source and digest" guarantee because the trusted builders produce the provenance in a separate job from the user's build steps, not because slsa-verifier checks the list.