artifact_type: pipeline_bom
sample_status: synthetic_illustrative
evidence_snapshot:
  artifact_name: payment-service
  artifact_version: 2.4.1
  build_id: build-8842
  commit_sha: a1b2c3d4e5f6
  repository: https://github.com/example/payment-service
  dependencies:
    - name: libcrypto
      version: 3.1.2
      source: internal_registry
      hash: sha256:...
    - name: web-framework
      version: 5.0.1
      source: public_registry
      hash: sha256:...
  scanner_results:
    - tool: primary_sast
      high_findings: 0
      critical_findings: 0
      completed_at: 2026-07-20T09:12:00Z
    - tool: container_scan
      critical_findings: 0
      completed_at: 2026-07-20T08:45:00Z
  build_provenance:
    builder: ci-builder-07
    build_started_at: 2026-07-20T08:30:00Z
    build_completed_at: 2026-07-20T08:55:00Z
    invocation_uri: https://ci.example.org/runs/8842
policy_version: v1.3.2
policy_digest: sha256:a1b2c3...f4e5d6
freshness_state: fresh
trust_state: qualified
runtime_corroboration:
  source: runtime_telemetry
  status: not_deployed
dsse_envelope:
  payload_type: application/vnd.gosentrix.bom+json
  signatures:
    - keyid: bom-signer-2026
      sig: '...'
decision_fingerprint: sha256:9f8e7d...6c5b4a
downgrade_reason_codes: []
replay_command: gosentrix replay --bom gosentrix:bom:payment-service:2.4.1@build-8842 --policy-version v1.3.2