# Provenance & Attestation Specification
Rivox automatically generates signed supply-chain attestations saved to `.rivox/provenance.json`.
---
## Standards Support
1. **in-toto Metadata**: Formats `.link` statements recording command arguments, input material digests, and output product digests.
2. **SLSA Build Level 2**: Generates SLSA v1.0 JSON statements linking build invocation context and source commit.
3. **SPDX 2.3 JCS JSON (RFC-005)**: Formats deterministic SPDX 2.3 SBOMs using `SOURCE_DATE_EPOCH` / zero-timestamp fallback and RFC 8785 JSON Canonicalization.
4. **Sigstore Rekor**: Signs attestations via keyless OIDC flows and registers digests into the Rekor transparency log.
See also: [security.md](security.md), [configuration.md](configuration.md).