{
  "scope": "entire-site",
  "fileCount": 58,
  "builtAt": "2026-06-28T22:09:42.484Z",
  "builder": {
    "repository": "bdelanghe/site",
    "commit": "f4467abe43fb785426dfab907007e2079c5355f5",
    "ref": "refs/heads/main",
    "runId": "28337621783",
    "workflowRef": "bdelanghe/site/.github/workflows/deploy.yml@refs/heads/main",
    "issuer": "https://token.actions.githubusercontent.com"
  },
  "siteManifest": {
    "file": "site.sha256",
    "sha256": "c0b07ed59d090ffd7e3da14f24c30178824f1bd205884cae7f6c51363a3c1be4",
    "bundle": "site.sha256.sigstore.json",
    "transparencyLog": "rekor.sigstore.dev",
    "rekorLogIndex": "2000363529",
    "rekorEntry": "https://search.sigstore.dev/?logIndex=2000363529",
    "verify": "cosign verify-blob \\\n  --bundle site.sha256.sigstore.json \\\n  --certificate-identity-regexp '^https://github.com/bdelanghe/site/' \\\n  --certificate-oidc-issuer https://token.actions.githubusercontent.com \\\n  site.sha256\n# then check the live bytes against the signed manifest:\nsha256sum -c site.sha256"
  },
  "intotoStatement": {
    "file": "attestation.intoto.json",
    "bundle": "attestation.intoto.json.sigstore.json",
    "predicateType": "https://slsa.dev/provenance/v1",
    "rekorLogIndex": "2000359647",
    "rekorEntry": "https://search.sigstore.dev/?logIndex=2000359647",
    "verify": "cosign verify-blob \\\n  --bundle attestation.intoto.json.sigstore.json \\\n  --certificate-identity-regexp '^https://github.com/bdelanghe/site/' \\\n  --certificate-oidc-issuer https://token.actions.githubusercontent.com \\\n  attestation.intoto.json"
  },
  "ociArtifact": {
    "registry": "ghcr.io",
    "ref": "ghcr.io/bdelanghe/robertdelanghe-dev:f4467ab",
    "digest": null,
    "pull": "oras pull ghcr.io/bdelanghe/robertdelanghe-dev:f4467ab",
    "verify": "cosign verify ghcr.io/bdelanghe/robertdelanghe-dev:f4467ab \\\n  --certificate-identity-regexp '^https://github.com/bdelanghe/site/' \\\n  --certificate-oidc-issuer https://token.actions.githubusercontent.com"
  },
  "caveat": "Provenance proves who built this site and that it is intact — not that the build was safe or authorized. Identity and integrity, not legitimacy.",
  "contentAddress": {
    "ipfs": {
      "cid": "bafybeigutqtiuz5g3c7ackx7e6jggow66jjttdmqcmtmrxbxivlwacpr5m",
      "cidV0": "QmcebEyfrxN8fX44pdYGosmbZQscuwZndWrTcPHQyALN42",
      "codec": "dag-pb",
      "multihash": "sha2-256",
      "scope": "served-site (site.sha256 file set)",
      "fileCount": 58,
      "pinned": false,
      "dnslink": false,
      "derivation": "generators/gen-cid.mjs — zero-dep UnixFS v1 (dag-pb, sha2-256, 256 KiB fixed chunker, no raw leaves)",
      "note": "IPFS UnixFS directory CID over the served site, computed with no daemon. Re-derives from the served bytes: `ipfs add -rQ --cid-version=1` over the same file set yields this CID (or `ipfs add -rQ` then `ipfs cid base32` from the v0 form)."
    }
  }
}