Continuum Attest 0.2.0 · Paper Moon · Apache-2.0
Continuum Attest creates verifiable build provenance. The CLI records build steps and hashes of declared inputs and artifacts, then, with signing enabled, generates a signed receipt that travels with your release.
A standalone CLI for Linux and macOS. Open source under Apache-2.0. No Continuum Attest account required.
Signed trust bundles, explicit verification requirements and signing separate from the build.
Banking & defence
From release to evidence
Your teams select a release and declare the files and steps to record within the existing build process.
Continuum Attest records the steps, their results and fingerprints of declared inputs and outputs during execution.
With signing enabled, Continuum Attest seals this information in a receipt to keep with the release and include in your audit file.
The recipient checks the signature with keys they trust. With the workspace and recomputation enabled, they also compare declared file hashes. These checks depend on the signer and build environment being trustworthy.
For your decisions
Produce evidence in an existing build job, keep it with your artifacts, and verify it on another machine.
Keep a signed receipt with each release, recording the steps and fingerprints of declared files. Your teams can retrieve this evidence without reconstructing the history from scattered logs.
File fingerprints let your teams compare declared files across runs. An optional check runs the pipeline twice and compares the results to test reproducibility.
With the receipt and approved trusted keys, a reviewer can check the signature offline, without access to your build platform or a Continuum Attest service.
Request a receipt alongside delivered software and compare its fingerprint with the recorded one. in-toto export lets you pass provenance records to your partners’ compatible tools.
Sectors
An audit to prepare for, a version to accept, an incident to investigate: Continuum Attest serves organisations that need to document how their critical software was built.
Sectors
Your challenge
How Continuum Attest helps
Your IT leadership needs to document changes to a critical service, including supplier deliveries. During an audit or incident, identifying the version and its build history becomes a priority.
A signed receipt links declared steps and files to the delivered version. It provides a traceability record to accompany your approvals and change controls.
Your quality team is preparing the file for a software version or model intended for a medical device. It needs to connect that version to retained build records and checks.
Declare the software, model and test reports as pipeline outputs. The receipt records their fingerprints to document the version reviewed in your quality file.
You accept a supplier delivery in a restricted environment. Your teams need to examine its provenance records without opening their network to an external service.
Transfer the receipt and approved keys under your own procedures. Verify the signature on an isolated workstation, without access to the supplier’s system or an Continuum Attest service.
Your operations leadership needs to retain software version records for installations with long service lives. Maintenance or an incident may require tracing their origin.
Keep each version’s receipt in your document management process. Recorded fingerprints and steps provide build traceability even after the original platform has changed.
Your programme lead needs to document the binary delivered to the customer and the materials used to build it. Multiple teams and subcontractors contribute to the delivery file.
Attach a signed receipt recording fingerprints of declared source files, configuration and outputs. It complements the records reviewed by your quality teams and customer.
Get started
Start with one build and its declared files. The CLI includes execution, signing, key management and offline verification.
Apache-2.0
Use Continuum Attest for personal or business projects under the same open-source licence. Run a pipeline or wrap a command in your existing CI job.
Install and run Continuum Attestcontinuum-attest
Linux and macOS, x86-64 and arm64. Requires Rust 1.89 or later. The package is continuum-attest; the installed command is attest.
cargo install continuum-attest --lockedVersion 0.2.0 is available on crates.io and in GitHub releases.
View the package on crates.ioPublic specifications
The formats are publicly documented so recipients can inspect the evidence and implement their own verifier.
Receipt schema, canonical file hashing, signing bytes and trust-store rules used by the current release.
Draft specification for future extensions. Version 0.2.0 does not run plugins; receipt verification works without them.
A valid receipt is evidence of signed claims and matching hashes. It does not certify software quality or compliance. Bundles carry revocations known at their last update; they cannot reveal later revocations. Causal roots are not published to a transparency log, and a signing key does not establish a legal identity.