Publish and verify log evidence

Glass Ocean 0.4.0 lets you add an independently recorded point of reference to a delivery. Publish a commitment to the signed receipt's causal root, retain the log's inclusion proof and deliver it with the software. The recipient checks that proof offline using a log key they approved independently.

Choose a log before publishing

You choose and provision the operator. Attest does not operate a public logging service. The first adapter supports a Tessera-compatible raw-entry writer, C2SP tlog-tiles reads and Ed25519 signed-note checkpoints.

Obtain endpoints, checkpoint origin and verifier key through your trusted provisioning channel. Producer configuration:

{
  "format": "attest-log/v1",
  "origin": "<OPERATOR_CHECKPOINT_ORIGIN>",
  "verifier_key": "<NAME+KEY_ID+BASE64_NOTE_VERIFIER_KEY>",
  "read_url": "https://<LOG_READ_ENDPOINT>/",
  "submit_url": "https://<LOG_WRITE_ENDPOINT>/add"
}

HTTPS is mandatory and redirects are refused. An optional tls_ca file adds your internal CA; relative paths resolve beside the configuration file. This profile supports no log API credentials: keep tokens out of URLs and repositories. Recipients need only format, origin and verifier_key, supplied independently of the delivery's sender.

Review what publication discloses

Publication is irreversible. The entry contains a fresh randomized commitment, without the causal root, source, artifacts or build logs. The operator still sees connection address, timing and request headers; observers see entries, order and retries. The evidence package retains the opening that lets its recipient associate the entry with the receipt. Review the versioned disclosure contract before enabling this feature.

Produce, publish and deliver

Running a build alone never publishes a log entry. Create a signed receipt, then pass its exact path to publication and packaging:

attest run --wrap --name build --input src/ --output dist/ --sign -- make dist
attest causal publish --receipt <EXACT_RECEIPT_PATH> \
  --log-config producer-log.json --output publication.json \
  --publication-policy required --timeout-secs 30 --format json
attest evidence pack <EXACT_RECEIPT_PATH> --workspace . \
  --publication publication.json --output release.attest.tar.zst

Provision a signing key first as shown in the CLI reference. Publication requires a trusted, signed receipt with a causal root. Existing receipts without one require a new build. Supply referenced capsule manifests when packing if the build uses capsules.

Keep publication.json. Attest records its intent durably before submitting; repeating the command with the same output resumes the same entry. A confirmed record is checked again without resubmission. At most three submission attempts are retained per record. Do not run concurrent publishers against one record.

Only inclusion verified under an authenticated checkpoint yields confirmed. A returned index alone does not. With required, missing confirmation exits 3; with optional, it exits 0 and retains an unconfirmed record and reason. Local errors exit 2. A timeout may mean acceptance without confirmation. The explicit deadline is 1–120 seconds, with bounded requests and retries.

Verify at the recipient without network

Deliver the archive through a channel appropriate for its contents. Provide receipt trust and log trust independently:

attest evidence verify release.attest.tar.zst \
  --trust-store recipient-trust/ --log-trust recipient-log.json \
  --require signature,success,artifacts,capsule,linkage,log-inclusion --format json

An unconfirmed record cannot satisfy log-inclusion. Missing log trust yields a skipped check, never trust derived from the archive. Invalid signatures, altered entries and invalid paths fail. A recipient may require publication even if the producer treated it as optional.

Compare independently obtained observations

Retain a signed checkpoint obtained independently of this delivery. Fetching the comparison proof is an explicit online operation; transfer the signed checkpoints and proof to the offline recipient:

attest causal fetch-consistency --first-checkpoint observed.note \
  --second-checkpoint publication.note --log-config producer-log.json \
  --output comparison.json
attest evidence verify release.attest.tar.zst \
  --trust-store recipient-trust/ --log-trust recipient-log.json \
  --log-checkpoint observed.note --log-consistency comparison.json \
  --require log-inclusion,log-consistency --format json

The delivery's exact signed note is retained in the confirmed publication record at outcome.checkpoint. Authenticated, unequal roots at the same size prove a conflict. Different nonempty sizes need a valid consistency path. A missing comparison is skipped and cannot satisfy log-consistency. A passed comparison covers those observations, without guaranteeing every observer's view, correct build execution or authenticated build time.

Opt in from GitHub or GitLab CI

Use the 0.4 integration and binary, following the versioned CI adoption guide. log-publication-policy defaults to off. Set it explicitly to required or optional with log-config; log-timeout-secs sets the deadline. An endpoint without an explicit policy is refused before the build.

After a successful signed build, log publication happens before evidence packaging. A failed build retains its exit code and publishes no log entry. log-publication-status, log-publication-reason and log-publication-record describe this operation separately from publication-status, which describes CI artifact upload. Required log publication fails with exit 3 even if evidence upload is optional; optional unconfirmed publication keeps its reason in the evidence package and status report.

Upgrade recipients to 0.4 before sending packages with log proofs. These use attest-evidence/v3; packages without a publication record remain v2. Existing v1/v2 packages and earlier receipt signatures remain verifiable.