{
  "scope": "entire-site",
  "fileCount": 66,
  "builtAt": "2026-08-15T19:10:50.502Z",
  "builder": {
    "repository": "bdelanghe/site",
    "commit": "40d877e4f67fd45ce4033e00af0dbd3db3921b1b",
    "ref": "refs/heads/main",
    "runId": "31903092014",
    "workflowRef": "bdelanghe/site/.github/workflows/deploy.yml@refs/heads/main",
    "issuer": "https://token.actions.githubusercontent.com"
  },
  "siteManifest": {
    "file": "site.sha256",
    "sha256": "3a7a403040908b6330cee8a0502cb98f76f06435dcfde6c05ed2d2f62cbabd77",
    "bundle": "site.sha256.sigstore.json",
    "transparencyLog": "rekor.sigstore.dev",
    "rekorLogIndex": "2478943183",
    "rekorEntry": "https://search.sigstore.dev/?logIndex=2478943183",
    "verify": "cosign verify-blob \\\n  --bundle site.sha256.sigstore.json \\\n  --certificate-identity-regexp '^https://github.com/bdelanghe/site/' \\\n  --certificate-oidc-issuer https://token.actions.githubusercontent.com \\\n  site.sha256\n# then check the live bytes against the signed manifest:\nsha256sum -c site.sha256"
  },
  "intotoStatement": {
    "file": "attestation.intoto.json",
    "bundle": "attestation.intoto.json.sigstore.json",
    "predicateType": "https://slsa.dev/provenance/v1",
    "rekorLogIndex": "2478942103",
    "rekorEntry": "https://search.sigstore.dev/?logIndex=2478942103",
    "verify": "cosign verify-blob \\\n  --bundle attestation.intoto.json.sigstore.json \\\n  --certificate-identity-regexp '^https://github.com/bdelanghe/site/' \\\n  --certificate-oidc-issuer https://token.actions.githubusercontent.com \\\n  attestation.intoto.json"
  },
  "ociArtifact": {
    "registry": "ghcr.io",
    "ref": "ghcr.io/bdelanghe/robertdelanghe-dev:40d877e",
    "digest": null,
    "pull": "oras pull ghcr.io/bdelanghe/robertdelanghe-dev:40d877e",
    "verify": "cosign verify ghcr.io/bdelanghe/robertdelanghe-dev:40d877e \\\n  --certificate-identity-regexp '^https://github.com/bdelanghe/site/' \\\n  --certificate-oidc-issuer https://token.actions.githubusercontent.com"
  },
  "caveat": "Provenance proves who built this site and that it is intact — not that the build was safe or authorized. Identity and integrity, not legitimacy.",
  "contentAddress": {
    "ipfs": {
      "cid": "bafybeia6q25hz5rgtuu4o5gena4rixi7xaus52jxymwhh6pmq7yzkxcn3e",
      "cidV0": "QmQPp6TsbyFJBvvtYC427qJLnWtaGMk3rEMVU8QHj4ZFDz",
      "codec": "dag-pb",
      "multihash": "sha2-256",
      "scope": "served-site (site.sha256 file set)",
      "fileCount": 66,
      "pinned": false,
      "dnslink": false,
      "derivation": "generators/gen-cid.mjs — zero-dep UnixFS v1 (dag-pb, sha2-256, 256 KiB fixed chunker, no raw leaves)",
      "note": "IPFS UnixFS directory CID over the served site, computed with no daemon. Re-derives from the served bytes: `ipfs add -rQ --cid-version=1` over the same file set yields this CID (or `ipfs add -rQ` then `ipfs cid base32` from the v0 form)."
    }
  }
}