Verify provenance for Java artifacts

Retrieve the provenance for Java artifacts from a Lightwell maven repository to verify their origin and integrity.

Before you begin
Copy link

You have access to the Lightwell Maven repository. For more information, see Lightwell Network repository access and Create a Lightwell Network service account.

Procedure

  1. Save the PNC Provenance Signing Key 1 public key to a local file named pnc-provenance-signing-key-1.pub: 
    $ cat > pnc-provenance-signing-key-1.pub << 'EOF'
  -----BEGIN PUBLIC KEY-----
  MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYFyYXLNpOXF46lNdwKgOthCsOZ0W
  5Uc29eO5IQzw2PKVkdpb781AZ/sUh7dSpe3hjjTu2brbjtOH1FWhO2Mmrg==
  -----END PUBLIC KEY-----
  EOF
  2. Download a Java artifact and its matching provenance bundle from the same Maven coordinate directory. The provenance bundle file name uses the following pattern: 
    <artifactId>-<version>.provenance.sigstore.json

    where:

    <artifactId>
    Specifies the ID of the artifact to verify.
    <version>
    Specifies the version of the Maven artifact.
  3. Verify the artifact and provenance bundle with Cosign:
    Note
    The artifact and provenance bundle must be the matching pair for the same Maven coordinate and version. This verifies that the Supply-chain Levels for Software Artifacts (SLSA) provenance attestation was signed by the PNC Provenance Signing Key 1, and that its subject digest matches the downloaded artifact.
     
    $ cosign verify-blob-attestation \
      --type https://slsa.dev/provenance/v1 \
      --key pnc-provenance-signing-key-1.pub \
      --bundle <artifactId>-<version>.provenance.sigstore.json \
      <artifactId>-<version>.jar