Application Provenance

Build provenance and attestations for the LinnemanLabs web server binary

Provenance for the currently running server binary - source information, build attestations, vulnerability scans, SBOMs, licensing, and container metadata. The application is a custom Go binary built with security and observability as primary concerns.

Source: linnemanlabs-web on GitHub

Source: build-system on GitHub

This page currently covers application-level provenance. I’m working toward extending attestations down through the full trust hierarchy - OS-level integrity (IMA/EVM), dm-verity verified filesystems, kernel lockdown, UEFI Secure Boot, and TPM-based hardware attestation - so that every layer is cryptographically anchored to the one below it.

tl;dr · what verifies today

app — · —

verify --bundle app --summary

kms signature aws-kms

keyless signature fulcio · pending

transparency log rekor #pending, #—

timestamp rfc3161 · pending

artifact digest —

verifying… at —

trust attestation

Every release is dual-signed: an AWS KMS key signs the artifacts and inventory, and a keyless Fulcio certificate - minted from the workflow's GitHub OIDC identity - is logged to Rekor and anchored with an RFC 3161 timestamp. Both chains root in the self-hosted stack at trust.linnemanlabs.com.

aws kms signature

signed artifacts index inventory release sigstore bundle

identity

version —

track —

built —

go —

release id —

build id —

binary sha-256 —

artifact digest —

source → build → artifact

source

application source

—@—

build

github actions

— · run #—

artifact

container image

—

posture

policy gate — · worst — · enforcement —

vulnerabilities

—

critical

—

high

—

medium

—

low

—

negligible

—

unknown

total findings —

scanned —

licenses

status —

without license —

denied found none

software bill of materials

source packages —

artifact packages —

evidence ledger

application evidence - findings, SBOM packages, licenses, policy, attestations, artifacts for auditors

build tooling

tool	role	version	sha-256
Go	binary toolchain	—	—
cosign	signing	—	—
syft	sbom generator	—	—
grype	vuln scanner	—	—
trivy	vuln scanner	—	—
govulncheck	vuln scanner (Go)	—	—

vulnerability scan

scope—

deduplication—

gate threshold—

scanners

per-scanner results

show findings hide findings

software bill of materials

generated at

—

generators

formats produced

show all packages hide packages

licenses

licenses found

show packages by license hide packages by license

release policy

enforcement—

allow if VEX—

unknown licenses—

block on severity

allowed licenses

denied licenses

attestations

total—

source—

artifact—

SBOM scan license

show attestation files hide attestation files

evidence files

file count

—