Record reported build provenance

stella attest build creates a real SLSA provenance v1 statement for an exact SHA-256 subject, signs it through Evidence’s configured signer, records it, and returns the original retained DSSE envelope. Repository, commit, builder and run are caller assertions. A valid signature authenticates that statement; it does not establish independent proof that the named CI execution occurred or confer a SLSA assurance level.

The operator must first supply the actual Evidence backend, an authenticated tenant-bound client with attest:create and attest:read, and an existing configured Evidence key ID. The service must have a working primary transparency log and archive. This command does not install a CI job, enroll a key, grant a scope, admit public trust or configure storage.

stella attest build \
  --subject "$BUILT_IMAGE_DIGEST_REFERENCE" \
  --repo "$SOURCE_REPOSITORY_URL" \
  --commit "$FULL_SOURCE_COMMIT" \
  --builder "$REPORTED_BUILDER_URI" \
  --pipeline "$ACTUAL_RUN_REFERENCE" \
  --key-id "$CONFIGURED_EVIDENCE_KEY_ID" \
  --output ./build-provenance.dsse.json

The subject must carry a full SHA-256 digest, or use --subject-digest with a matching full digest. Conflicting digest inputs fail. Commit is a full 40- or 64-hex Git object ID. Repository and builder are absolute URIs; a run reference is required. The reported builder must be supplied through --builder or STELLAOPS_BUILDER_ID; the CLI does not invent itself as the build system or turn a workflow/job label into a builder URI. Flags override the supported CI environment fallbacks. Repository/builder/run URIs containing userinfo credentials are refused before verbose output or signing. CI_PROJECT_URL precedes CI_REPOSITORY_URL, which can contain CI clone credentials. Supply a credential-free locator explicitly when needed. A missing backend refuses online success; only explicit --offline writes an unsigned, caller-reported statement. --no-rekor is refused for online recording.

The calls are POST /api/evidence/v1/attestations:sign, then POST /api/evidence/v1/rekor/entries, then POST /api/evidence/v1/attestations:export. The signing service binds authenticated issuer/subject/client/tenant and actual key ID/algorithm/provider/mode as a signed byproduct, separate from the caller’s lineage. Submission verifies the configured signature, exact subject and producer binding. It cannot return success unless the archive returns the exact signed bytes. The CLI returns those retained bytes, including on a retry that reuses an earlier randomized signature.

Identical canonical statement, producer and signer resolve to one tenant-owned recorded identity. Changed metadata or signer creates a different statement. An interrupted attempt can already have reached the transparency log: retry is not a promise of exactly-once log execution. If previously accepted archive bytes are missing or corrupt, retry fails rather than pair replacement bytes with the old receipt. The original envelope must be recovered through the owner archive procedure before it can be exported again.

Read the result through the existing Release Orchestrator provenance reader or Evidence’s exact-subject list/export APIs. Discovery establishes presence and recorded attribution. UUID-only inclusion verification does not check the DSSE signature; independent verification must use the retained envelope and configured public identity. See Evidence architecture.

Source checks: BuildProvenanceComposer, AttestorLinkClient, BuildProvenanceContract and AttestorSubmissionService. Reverify the serving path with pwsh tools/scripts/test-targeted-xunit.ps1 -Project src/Cli/__Tests/StellaOps.Cli.Tests/StellaOps.Cli.Tests.csproj -Class '*BuildProvenance*' -BuildProjectReferences. The CCP-083 source receipt records verified source f87a08736519a20970fb1d39f4e78bddadc53a18 and exact test counts; live R3 CI/client/key/publication/deployment acceptance remains separate.

For that later acceptance window, identify the actual CI repository/workflow/ref, the approved tenant-bound client and protected credential pointer, the existing Evidence signing key ID and independently approved public identity, and the qualified CLI/Evidence versions. Supply the real built image digest, full source commit and run reference from that execution. Approval must cover the CI change and run, any missing client/key/trust enrollment, publication and deployment separately. Retain the serving subject list, exact exported envelope, independent signature result and second-tenant denial from that run. Source tests and operator entered fields cannot replace those live observations.