{
 "_type": "https://in-toto.io/Statement/v1",
 "subject": [
  {
   "name": "corecp-panel_0.50.0_amd64.deb",
   "digest": {
    "sha512": "0bb0f0204bfe020d7425ddc48505853c632cb893e136dd462322fc240a19ae5ecc797a79611a782ec3be99a22555b0d7381ccf76f61ae343c09226925923ad4b",
    "sha256": "eef1d13ced70e5eb23a59b1a4876b527de1772316ee137ac16ecf9c738ada3fa"
   }
  }
 ],
 "predicateType": "https://slsa.dev/provenance/v1",
 "predicate": {
  "buildDefinition": {
   "buildType": "https://corecp.dev/build/deb/v1",
   "externalParameters": {
    "package": "corecp-panel",
    "version": "0.50.0",
    "architecture": "amd64",
    "buildScript": "corecp-panel/packaging/build-deb.sh",
    "sourceCommit": "3527894a1c93700cfc7b51fd0a2558b6b280f273",
    "sourceTag": "v0.50.0",
    "sourceRoute": "remote",
    "sourceRepository": "git@github-corecp:xrated86/corecp.git"
   },
   "internalParameters": {
    "toolchain": {
     "go": "go version go1.26.9 linux/amd64",
     "dpkg-deb": "Debian 'dpkg-deb' package archive backend version 1.23.7 (amd64).",
     "node": "v22.22.1"
    }
   },
   "resolvedDependencies": [
    {
     "name": "corecp-panel/go.mod",
     "digest": {
      "sha256": "00b7de2559ffe33242384911a5ea032070f05c129b5c435f0376a2de434859e2"
     }
    },
    {
     "name": "corecp-panel/go.sum",
     "digest": {
      "sha256": "1a0b53c1ea8a18f58dffffdfcde325e2cb1c32538c311fa5632726d55f7da10d"
     }
    },
    {
     "name": "corecp-panel/web/package-lock.json",
     "digest": {
      "sha256": "7ea15ce0a441e049cff58c0af3f8c1fea4d660217d8ea3ce5a69e89f0019e7e0"
     }
    },
    {
     "name": "supply-chain/inventory.json",
     "digest": {
      "sha256": "bba0b41f4d4c4673d188aa657b286881a1e5292a26526388b42c8d348eed5816"
     }
    }
   ]
  },
  "runDetails": {
   "builder": {
    "id": "https://build.corecp.dev/corecp-build",
    "builderDependencies": []
   },
   "metadata": {
    "invocationId": "corecp-panel-0.50.0-eef1d13ced70e5eb",
    "startedOn": "2026-10-11T10:27:47Z",
    "finishedOn": "2026-10-11T10:27:47Z"
   }
  }
 },
 "_note": "SLSA Build L1 with a signed statement. This document is produced by the build script itself and signed with the release key, which lives on the same machine that builds and serves the packages (docs/build-infra.md). That is enough to say what went into an artifact and to detect a change to this statement after the fact. It is not L2 or L3: the build is not run by an isolated service, nothing here attests that the source tree was unmodified, and the builder could produce a false statement about its own output. Read it as a manifest of intent that is hard to edit, not as a proof of an untampered build."
}