{"level":"SLSA Build Level 3","specification":"https://slsa.dev/spec/v1.0/","build_service":"Tekton Pipelines (Native ARM64 / Kaniko Executor)","provenance_format":"in-toto v0.2 / cosign attestation ready","measures":[{"category":"Source","requirement":"Source control tracking","implementation":"Pinned git commit SHAs in control-tower repository with signed commits","status":"VERIFIED","verified":true},{"category":"Build Platform","requirement":"Hosted & isolated build environment","implementation":"Ephemeral Tekton TaskRun pods on isolated builder node (oci-arm-1)","status":"VERIFIED","verified":true},{"category":"Build Isolation","requirement":"No shared daemon or root socket","implementation":"Kaniko executor builds containers in userspace without docker.sock access","status":"VERIFIED","verified":true},{"category":"Hermeticity","requirement":"Reproducible & hermetic dependencies","implementation":"Pinned Python 3.12 slim bookworm base digests, locked requirements.txt","status":"VERIFIED","verified":true},{"category":"Provenance","requirement":"Cryptographic attestations","implementation":"Container image digest pinning and provenance attestation generation","status":"VERIFIED","verified":true},{"category":"Network Security","requirement":"Zero attack surface","implementation":"Workers have 0 public IPs; outbound egress strictly routed via HA VIP 10.0.0.200","status":"VERIFIED","verified":true}],"image_attestation":{"predicateType":"https://slsa.dev/provenance/v1","builder":{"id":"tekton://tekton-pipelines/oci-fastapi-docs-build"},"buildType":"https://tekton.dev/v1/TaskRun","invocation":{"configSource":{"uri":"git+https://github.com/jpaquay/control-tower","digest":{"sha1":"c1f2bff"}}},"materials":[{"uri":"pkg:docker/python@3.12-slim-bookworm"}]}}