Proof sample
A pipeline BOM is an evidence snapshot that enumerates the source, dependencies, build provenance, and scan results associated with a specific artifact at a point in time.
This is a synthetic example for illustration.
| Field | Role |
|---|---|
| evidence_snapshot | The BOM content: source, dependencies, build, and scans. |
| policy_version | The policy version the BOM was checked against. |
| policy_digest | Cryptographic digest of the policy version. |
| freshness_state | Whether the evidence is within the policy freshness window. |
| trust_state | Qualification state, such as qualified or corroborated. |
| runtime_corroboration | Runtime evidence available at BOM time, if any. |
| dsse_envelope | Signing envelope protecting the snapshot. |
| decision_fingerprint | Reference fingerprint for downstream decisions. |
| replay_command | Command to reproduce the BOM qualification. |
Synthetic pipeline BOM (JSON)
{
"artifact_type": "pipeline_bom",
"evidence_snapshot": {
"artifact_name": "payment-service",
"artifact_version": "2.4.1",
"build_id": "build-8842",
"commit_sha": "a1b2c3d4e5f6",
"repository": "https://github.com/example/payment-service",
"dependencies": [
{
"name": "libcrypto",
"version": "3.1.2",
"source": "internal_registry",
"hash": "sha256:..."
},
{
"name": "web-framework",
"version": "5.0.1",
"source": "public_registry",
"hash": "sha256:..."
}
],
"scanner_results": [
{
"tool": "primary_sast",
"high_findings": 0,
"critical_findings": 0,
"completed_at": "2026-07-20T09:12:00Z"
},
{
"tool": "container_scan",
"critical_findings": 0,
"completed_at": "2026-07-20T08:45:00Z"
}
],
"build_provenance": {
"builder": "ci-builder-07",
"build_started_at": "2026-07-20T08:30:00Z",
"build_completed_at": "2026-07-20T08:55:00Z",
"invocation_uri": "https://ci.example.org/runs/8842"
}
},
"policy_version": "v1.3.2",
"policy_digest": "sha256:a1b2c3...f4e5d6",
"freshness_state": "fresh",
"trust_state": "qualified",
"runtime_corroboration": {
"source": "runtime_telemetry",
"status": "not_deployed"
},
"dsse_envelope": {
"payload_type": "application/vnd.gosentrix.bom+json",
"signatures": [
{
"keyid": "bom-signer-2026",
"sig": "..."
}
]
},
"decision_fingerprint": "sha256:9f8e7d...6c5b4a",
"downgrade_reason_codes": [],
"replay_command": "gosentrix replay --bom gosentrix:bom:payment-service:2.4.1@build-8842 --policy-version v1.3.2"
}The BOM links the artifact to a commit, build, dependencies, and scanner outputs.
trust_state and freshness_state record whether the snapshot met policy thresholds.
Multiple scanners and runtime telemetry can reference the same BOM.
The replay_command and dsse_envelope let later reviewers reconstruct the snapshot basis.
A pipeline BOM is an evidence snapshot that enumerates the source revision, dependencies, build provenance, and tool outputs associated with a specific artifact. It supplies the context in which later decisions are evaluated.
A decision artifact references a BOM as part of its evidence_snapshot. The BOM provides the artifact-specific facts; the decision artifact records whether those facts satisfy policy.
The policy version specifies the rules the BOM was checked against, such as freshness windows, required scanners, and allowed dependency sources. It makes the evaluation reproducible.
No. A clean BOM means the enumerated evidence met the policy thresholds at the time. It does not prove the absence of unknown vulnerabilities or future runtime behavior.
The public operating doctrine for release-evidence verification.
How GoSentrix qualifies evidence and evaluates policy.
A worked example of a policy-bound release decision.
Move from ticket closure to verified remediation evidence.
GoSentrix qualifies pipeline BOMs and other evidence snapshots so release decisions are based on complete, versioned, reproducible facts.