{
"rule": "https://packslip.dev/release/v1/#the-release-statement",
"description": "Whether a release statement is structurally valid, checked after the signature and before anything is installed. `accept` means a consumer proceeds to the digest checks; `reject` means it refuses the document. `reason` quotes the rule at issue. These are payloads, not bundles: signature verification is sigstore's and is not restated here.",
"cases": [
{
"name": "a minimal release statement",
"expect": "accept",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
}
},
{
"name": "two platforms",
"expect": "accept",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
},
{
"name": "tool-darwin-arm64.tar.xz",
"digest": {
"sha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
},
{
"name": "tool-darwin-arm64.tar.xz",
"os": "darwin",
"arch": "aarch64",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
}
},
{
"name": "an unknown field is ignored, not rejected",
"expect": "accept",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
},
"something_a_later_revision_added": {
"x": 1
}
}
},
"reason": "A later revision of version 1 may add optional fields; an older consumer reads the document anyway."
},
{
"name": "a release that does not pin its signing workflow",
"expect": "accept",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com",
"pin_workflow": false
}
}
},
"comment": "pin_workflow is optional and true when absent. false declares that consumers hold later releases to the repository, not the workflow (Reusable workflows)."
},
{
"name": "a pin_workflow that is not a boolean",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com",
"pin_workflow": "false"
}
}
},
"reason": "identity.pin_workflow is a boolean; a string is not false."
},
{
"name": "a signing scheme the specification does not define",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-x509",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
},
"reason": "identity.scheme is `sigstore-oidc` or `sigstore-key`. A closed vocabulary: any other value makes the document invalid."
},
{
"name": "an attested_by value the specification does not define",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
},
"attested_by": "mirror"
}
},
"reason": "attested_by is `vendor` or `repackager`. A closed vocabulary: any other value makes the document invalid."
},
{
"name": "a keyless identity with an empty key_id",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "",
"issuer": "https://token.actions.githubusercontent.com"
}
}
},
"reason": "key_id is the certificate's subject identity. Both key_id and issuer are required for sigstore-oidc, and neither is empty."
},
{
"name": "a keyless identity with no key_id",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"issuer": "https://token.actions.githubusercontent.com"
}
}
},
"reason": "identity.key_id is required."
},
{
"name": "a keyless identity with no issuer",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0"
}
}
},
"reason": "identity.issuer is the OIDC issuer, required for sigstore-oidc."
},
{
"name": "a keyless identity with an empty issuer",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": ""
}
}
},
"reason": "For sigstore-oidc, key_id is the certificate's subject identity and issuer is the OIDC issuer. Both are required for sigstore-oidc, and neither is empty."
},
{
"name": "extensions carry data the specification does not define",
"expect": "accept",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
],
"extensions": {
"mise": {
"install_hint": "brew"
}
}
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
},
"extensions": {
"example.com": {
"build_id": "20260901.3"
}
}
}
}
},
{
"name": "the wrong predicate type",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/releases/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
},
"reason": "A consumer keeps only the document whose predicateType is release/v1."
},
{
"name": "a version that is not semver",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.2",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
},
"reason": "`version` is a semver 2.0.0 version. A consumer refuses anything else; the tag may still be spelled v1.2."
},
{
"name": "a project name with a scheme",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "https://github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
},
"reason": "A project name is a host with an optional path, with no URL scheme and no trailing slash."
},
{
"name": "a project host with no dot",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "localhost/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
},
"reason": "The host is lowercase and contains at least one dot."
},
{
"name": "an empty path segment in the project name",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com//tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
}
},
{
"name": "a project path segment with a tilde",
"expect": "accept",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "example.org/~tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
},
"reason": "A project name's host is lowercase LDH labels with at least one dot and no port; its path segments use only ASCII letters, digits, `.`, `_`, `~`, and `-`."
},
{
"name": "a project host with a port",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "example.org:8443/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
},
"reason": "A project name's host is lowercase LDH labels with at least one dot and no port; its path segments use only ASCII letters, digits, `.`, `_`, `~`, and `-`."
},
{
"name": "a project host label with an underscore",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "exa_mple.org/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
},
"reason": "A project name's host is lowercase LDH labels with at least one dot and no port; its path segments use only ASCII letters, digits, `.`, `_`, `~`, and `-`."
},
{
"name": "a project path segment with a character outside the set",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "example.org/@scope/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
},
"reason": "A project name's host is lowercase LDH labels with at least one dot and no port; its path segments use only ASCII letters, digits, `.`, `_`, `~`, and `-`."
},
{
"name": "no artifacts",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
},
"reason": "A release statement describes at least one artifact."
},
{
"name": "an artifact that no subject pins",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64-renamed.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
},
"reason": "Every artifact must appear in `subject` with its digest, or nothing signs its bytes."
},
{
"name": "two artifacts with the same name",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
},
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
}
},
{
"name": "two artifacts a consumer could not choose between",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
},
{
"name": "tool-linux-x64-b.tar.xz",
"digest": {
"sha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
},
{
"name": "tool-linux-x64-b.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
},
"reason": "They share os, arch, libc, variant and format, so nothing in the document tells them apart. The vendor must scope or name them differently."
},
{
"name": "a published_at with an offset other than Z",
"expect": "accept",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T02:00:00+02:00",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
},
"reason": "A consumer accepts any RFC 3339 offset and compares instants; only a publisher must write UTC with Z."
},
{
"name": "a published_at that is not a timestamp",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "September 2026",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
}
},
{
"name": "an uppercase token",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "Linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
},
"reason": "Vocabulary tokens are lowercase."
},
{
"name": "an executable name that is a path",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
{
"name": "sub/tool",
"path": "bin/tool"
}
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
},
"reason": "`bin` names go on PATH; a name cannot contain a separator."
},
{
"name": "an executable name, resource bin, or exec program ending in .exe, in any letter case, names the command without it",
"expect": "accept",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
},
{
"name": "tool-windows-x64.zip",
"digest": {
"sha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
}
},
{
"name": "tool.usage.kdl",
"digest": {
"sha256": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
},
{
"name": "tool-windows-x64.zip",
"os": "windows",
"arch": "x86_64",
"size": 5,
"format": "zip",
"bin": [
{
"path": "tool.exe",
"name": "tool.exe"
}
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
},
"resources": [
{
"kind": "completion",
"shell": "bash",
"archive": "share/tool.bash"
},
{
"kind": "completion",
"shells": [
"zsh"
],
"exec": [
"tool.EXE",
"completion",
"{shell}"
]
},
{
"kind": "cli-spec",
"format": "usage",
"bin": "tool.EXE",
"asset": "tool.usage.kdl"
}
]
}
},
"reason": "A consumer reads an artifact `bin` entry's `name`, a resource's `bin`, or the first element of a resource's `exec` that ends in `.exe` in any letter case as the name without it. Both artifacts therefore name the one command `tool`, so the completions need no `bin`, the exec completion's `tool.EXE` runs a declared `bin` name, and the cli-spec's `tool.EXE` names `tool`."
},
{
"name": "a required command minimum that does not start with a digit",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
],
"requires": {
"bin": [
{
"name": "java",
"min": "v17"
}
]
}
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
},
"reason": "A `min` is an ASCII digit followed by ASCII letters, digits, `.`, `-`, and `+`. A consumer refuses a document with any other `min`."
},
{
"name": "an empty required command minimum",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
],
"requires": {
"bin": [
{
"name": "java",
"min": ""
}
]
}
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
},
"reason": "An empty `min` is outside the minimum grammar, so a consumer refuses it. A vendor with no minimum leaves `min` out."
},
{
"name": "a required command minimum that cannot be compared numerically",
"expect": "accept",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
],
"requires": {
"bin": [
{
"name": "java",
"min": "17-ea"
}
]
}
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
},
"reason": "`17-ea` follows the `min` grammar, so the document is valid. It is not dot-separated numbers, so the requirement check is unknown and the consumer warns before installing."
},
{
"name": "a glibc_min and an os_min outside the minimum grammar",
"expect": "accept",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
],
"requires": {
"glibc_min": "v2.31",
"os_min": "linux-5.10"
}
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
},
"reason": "A vendor must write `glibc_min` and `os_min` in the grammar of `min`, but a consumer does not refuse a document that does not: both checks are unknown."
},
{
"name": "an executable with an empty name",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
{
"path": "bin/tool",
"name": ""
}
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
},
"reason": "A command name is the name as typed, without `.exe`, and is not empty."
},
{
"name": "an executable path that ends in a slash",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool/"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
},
"reason": "A command name is not empty, so a string entry's path ends in a file name rather than `/`; `tool/` names no file."
},
{
"name": "requires written as an array",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
],
"requires": []
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
},
"reason": "`requires` is an object. An array, even an empty one, is not."
},
{
"name": "an identity written as an array of its fields",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": [
"sigstore-oidc",
"https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"https://token.actions.githubusercontent.com"
]
}
},
"reason": "`identity` is an object. An array of its values in field order is not."
},
{
"name": "a digest written as an array",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": [
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
]
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
},
"reason": "`subject[].digest` is an object keyed by algorithm, not an array."
},
{
"name": "a source written as an array",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
},
"source": [
"https://github.com/example/tool"
]
}
},
"reason": "A supplied `source` is an object that includes `repo`, not an array."
},
{
"name": "an executable written as an array of its path and name",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
[
"bin/tool",
"tool"
]
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
}
}
},
"reason": "A `bin` entry is a path or a `{ path, name }` object, not an array."
},
{
"name": "static completion names one shell",
"expect": "accept",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
},
"resources": [
{
"kind": "completion",
"shell": "bash",
"archive": "share/tool.bash"
}
]
}
}
},
{
"name": "exec completion lists shells and substitutes in argv",
"expect": "accept",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
},
"resources": [
{
"kind": "completion",
"shells": [
"bash"
],
"exec": [
"tool",
"completion",
"{shell}"
]
}
]
}
}
},
{
"name": "exec completion substitutes shells in environment",
"expect": "accept",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
},
"resources": [
{
"kind": "completion",
"shells": [
"bash"
],
"exec": [
"tool"
],
"env": {
"COMPLETE": "{shell}"
}
}
]
}
}
},
{
"name": "exec completion cannot use a static single-shell declaration",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
},
"resources": [
{
"kind": "completion",
"shell": "bash",
"exec": [
"tool",
"completion",
"bash"
]
}
]
}
},
"reason": "With exec, shells lists every shell the command generates and {shell} stands for each in the argv or in an env value."
},
{
"name": "exec completion needs a shell placeholder",
"expect": "reject",
"statement": {
"_type": "https://in-toto.io/Statement/v1",
"subject": [
{
"name": "tool-linux-x64.tar.xz",
"digest": {
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}
}
],
"predicateType": "https://packslip.dev/release/v1",
"predicate": {
"project": "github.com/example/tool",
"version": "1.0.0",
"published_at": "2026-09-01T00:00:00Z",
"artifacts": [
{
"name": "tool-linux-x64.tar.xz",
"os": "linux",
"arch": "x86_64",
"libc": "gnu",
"size": 5,
"format": "tar.xz",
"bin": [
"tool"
]
}
],
"identity": {
"scheme": "sigstore-oidc",
"key_id": "https://github.com/example/tool/.github/workflows/release.yml@refs/tags/v1.0.0",
"issuer": "https://token.actions.githubusercontent.com"
},
"resources": [
{
"kind": "completion",
"shells": [
"bash"
],
"exec": [
"tool",
"completion",
"bash"
]
}
]
}
},
"reason": "With exec, shells lists every shell the command generates and {shell} stands for each in the argv or in an env value."
}
]
}