IMPORTANT: Developer documentation for the current development branch. This content is unreleased, may change without notice, and must not be treated as Buildish release documentation.

Release manifests, inventories, and verification report types

Typed Buildish release manifests, emitted verification reports, inspection-bundle payloads, and related helper contracts.

Typed Buildish release manifests, emitted verification reports, inspection-bundle payloads, and related helper contracts.

Back to the reference overview.

Type index

ArtifactReproducibilityBuildOverrideReport

Sparse local override delta applied to one canonical build recipe.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
command list[NonEmptyString] no Literal argv list that Buildish executed or recommends for the related step.
working_directory NonEmptyString no Repository-root-relative working directory that Buildish recorded in the related canonical recipe, effective execution, or local override block.
output_globs list[NonEmptyString] no Repository-root-relative glob patterns that identify expected outputs of the related build recipe.
env_keys list[NonEmptyString] no Environment variable names referenced by the related recipe or override without exposing their values.

ArtifactReproducibilityCanonicalBuildRecipeReport

Canonical build recipe declared by the verified source tree for one profile.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
command list[NonEmptyString] no Literal argv list that Buildish executed or recommends for the related step.
working_directory NonEmptyString no Repository-root-relative working directory that Buildish recorded in the related canonical recipe, effective execution, or local override block.
output_globs list[NonEmptyString] no Repository-root-relative glob patterns that identify expected outputs of the related build recipe.
env_keys list[NonEmptyString] no Environment variable names referenced by the related recipe or override without exposing their values.

ArtifactReproducibilityCanonicalRecipeReport

Canonical repo-defined recipe for one reproducibility profile.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
build ArtifactReproducibilityCanonicalBuildRecipeReport yes Nested build recipe or effective build execution block for one reproducibility contract.

ArtifactReproducibilityEffectiveBuildExecutionReport

Observed build invocation details for one executed reproducibility profile.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
command list[NonEmptyString] no Literal argv list that Buildish executed or recommends for the related step.
working_directory NonEmptyString no Repository-root-relative working directory that Buildish recorded in the related canonical recipe, effective execution, or local override block.
output_paths list[NonEmptyString] no Concrete output paths that Buildish observed from the effective rebuild execution.
injected_environment_keys list[NonEmptyString] no Environment variable names that Buildish injected into the effective rebuild subprocess.

ArtifactReproducibilityEffectiveExecutionReport

Effective execution details for one reproducibility run.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
backend Literal[‘host-direct’] no Execution backend name that performed the related Buildish action or reproducibility run.
build ArtifactReproducibilityEffectiveBuildExecutionReport yes Nested build recipe or effective build execution block for one reproducibility contract.

ArtifactReproducibilityOverrideReport

Structured local override metadata for one reproducibility run.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
applied bool no Whether the related local override block was applied to the effective rebuild execution.
build ArtifactReproducibilityBuildOverrideReport no Nested build recipe or effective build execution block for one reproducibility contract.

ArtifactReproducibilityReport

Observed local rebuild comparison results for one artifact.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
profile_id NonEmptyString yes Reproducibility profile identifier selected for the related artifact or source verification.
verdict VerificationVerdict yes Structured verification or reproducibility verdict for the related subject.
comparison_mode NonEmptyString yes Declared reproducibility comparison mode used for the related artifact or profile.
canonical_recipe ArtifactReproducibilityCanonicalRecipeReport no Canonical rebuild recipe resolved from the verified source tree or other authoritative Buildish configuration.
effective_execution ArtifactReproducibilityEffectiveExecutionReport no Effective build execution details that Buildish actually ran after applying local overrides or runtime defaults.
override ArtifactReproducibilityOverrideReport no Explicit local reproducibility override details applied on top of the canonical recipe.
matches_remote_bytes bool no Whether the rebuilt artifact bytes matched the staged or signed remote bytes exactly.
failure_class NonEmptyString no Structured failure classification that summarizes the main reason why verification or reproducibility failed.
archive_analysis ShallowArchiveAnalysisReport no Shallow top-level archive comparison details retained for reproducibility inspection.
evidence list[InspectionEvidenceReference] no Inspection-bundle evidence references retained for one reproducibility result.
issues list[str] no Collected human-readable issues observed for the related verification, inspection, or reproducibility subject.

AsfKeysTrustRootRead

Tolerant ASF KEYS trust-root subset accepted by verify-rc readers.

Field Type Required Description
uri object yes Canonical artifact or signature URI recorded in a Buildish manifest or verification report.
known_length_bytes object yes Expected byte length of the pinned ASF KEYS file when Buildish establishes the trust root.
known_prefix_sha512 object yes Pinned SHA-512 digest prefix that Buildish expects the ASF KEYS file to start with.

AuthoritativeManifestReferenceRead

Tolerant authoritative-manifest reference accepted by verify-rc readers.

Field Type Required Description
uri object yes Canonical artifact or signature URI recorded in a Buildish manifest or verification report.
checksum_uris object yes Manifest-relative or absolute URIs of checksum sidecars associated with the authoritative staged manifest.
signatures object yes Declared detached signature references associated with the related artifact or manifest.

ChecksumVerificationReport

Observed checksum verification results for one downloaded artifact.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
algorithm Literal[‘sha256’, ‘sha512’] no Checksum or digest algorithm name that Buildish used for the related verification or report entry.
value str no Declared checksum or digest value recorded in the related payload.
matches_manifest bool no Whether the observed checksum or digest matched the value declared in the authoritative manifest or inventory.
sidecar_verified bool no Whether the detached checksum sidecar associated with this report entry was fetched and verified successfully.

DraftGitHubReleaseRead

Tolerant draft-release pointer accepted by verify-rc readers.

Field Type Required Description
repository object yes Repository identifier or repository name associated with the related provenance or external-auth record.
tag object yes Tag name associated with the related release, workflow fixture, or synthetic GitHub tag-object payload.
url object yes Canonical browser or download URL associated with the related record.

FileLikeReproducibilityMetadata

Retained comparison metadata for one file-like reproducibility failure or drift.

Field Type Required Description
artifact_id NonEmptyString yes Stable identifier for one source, secondary, or emitted artifact within Buildish release tooling.
kind Literal[‘generic-file’, ‘generic-file-with-openpgp’, ‘python-distribution’, ’npm-package’] yes Declared artifact or report kind discriminator.
profile_id NonEmptyString yes Reproducibility profile identifier selected for the related artifact or source verification.
comparison_mode NonEmptyString yes Declared reproducibility comparison mode used for the related artifact or profile.
canonical_recipe ArtifactReproducibilityCanonicalRecipeReport no Canonical rebuild recipe resolved from the verified source tree or other authoritative Buildish configuration.
effective_execution ArtifactReproducibilityEffectiveExecutionReport no Effective build execution details that Buildish actually ran after applying local overrides or runtime defaults.
override ArtifactReproducibilityOverrideReport no Explicit local reproducibility override details applied on top of the canonical recipe.
failure_class NonEmptyString no Structured failure classification that summarizes the main reason why verification or reproducibility failed.
archive_analysis ShallowArchiveAnalysisReport no Shallow top-level archive comparison details retained for reproducibility inspection.
staged_artifact RetainedArtifactSnapshot yes Retained snapshot metadata for the staged artifact bytes used as the comparison target.
rebuilt_outputs list[RebuiltOutputSnapshot] no Snapshot metadata for files or trees produced by a local rebuild step.
matches_remote_bytes bool no Whether the rebuilt artifact bytes matched the staged or signed remote bytes exactly.
issues list[str] no Collected human-readable issues observed for the related verification, inspection, or reproducibility subject.

GenericFileSecondaryArtifact

A standalone file artifact tracked in the signed vote manifest.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
artifact_id object yes Stable identifier for one source, secondary, or emitted artifact within Buildish release tooling.
kind Literal[‘generic-file’] no Declared artifact or report kind discriminator.
role object no Artifact role within the RC manifest, such as source artifact, vote-manifest supplement, or convenience artifact.
artifact_origin object no Origin classification describing whether the artifact came from a source build, registry, or repository staging area.
git_commit_sha object no Git commit SHA recorded for the related artifact, manifest, or provenance block.
reproducibility object no Reproducibility policy or result block associated with the related source or secondary artifact.
inventory object no Signed inventory or supplemental staging metadata associated with the related artifact.
filename NonEmptyString yes Artifact filename as seen in staging, manifests, or retained evidence.
uri NonEmptyString yes Canonical artifact or signature URI recorded in a Buildish manifest or verification report.
checksums Sha512Checksums yes Declared checksum sidecars or signed checksum values associated with this artifact.
signatures list[SignatureReference] no Declared detached signature references associated with the related artifact or manifest.

GenericFileVerificationReport

Verification report for one generic secondary file.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
artifact_id NonEmptyString yes Stable identifier for one source, secondary, or emitted artifact within Buildish release tooling.
kind Literal[‘generic-file’, ‘generic-file-with-openpgp’] yes Declared artifact or report kind discriminator.
verdict VerificationVerdict yes Structured verification or reproducibility verdict for the related subject.
issues list[str] no Collected human-readable issues observed for the related verification, inspection, or reproducibility subject.
filename NonEmptyString yes Artifact filename as seen in staging, manifests, or retained evidence.
uri NonEmptyString yes Canonical artifact or signature URI recorded in a Buildish manifest or verification report.
checksum ChecksumVerificationReport yes Checksum verification details for one downloaded or rebuilt artifact.
signatures list[SignatureVerificationPayload] no Declared detached signature references associated with the related artifact or manifest.
inventory InventoryVerificationReport no Signed inventory or supplemental staging metadata associated with the related artifact.
reproducibility ArtifactReproducibilityReport no Reproducibility policy or result block associated with the related source or secondary artifact.

GenericFileWithOpenPgpSecondaryArtifact

A standalone file artifact that requires at least one detached signature.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
artifact_id object yes Stable identifier for one source, secondary, or emitted artifact within Buildish release tooling.
kind Literal[‘generic-file-with-openpgp’] no Declared artifact or report kind discriminator.
role object no Artifact role within the RC manifest, such as source artifact, vote-manifest supplement, or convenience artifact.
artifact_origin object no Origin classification describing whether the artifact came from a source build, registry, or repository staging area.
git_commit_sha object no Git commit SHA recorded for the related artifact, manifest, or provenance block.
reproducibility object no Reproducibility policy or result block associated with the related source or secondary artifact.
inventory object no Signed inventory or supplemental staging metadata associated with the related artifact.
filename NonEmptyString yes Artifact filename as seen in staging, manifests, or retained evidence.
uri NonEmptyString yes Canonical artifact or signature URI recorded in a Buildish manifest or verification report.
checksums Sha512Checksums yes Declared checksum sidecars or signed checksum values associated with this artifact.
signatures list[SignatureReference] no Declared detached signature references associated with the related artifact or manifest.

InspectReproCountSummary

One count bucket emitted by inspect-repro machine-readable summaries.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
key NonEmptyString yes Stable grouping or category key used in one Buildish summary object.
count int yes Count value reported for one grouped summary bucket.

InspectReproReportV1

Machine-readable inspect-repro output for automation and post-processing.

Field Type Required Description
schema_version SchemaVersionV1 no Schema version of the enclosing Buildish JSON or YAML contract.
report_type Literal[‘inspect-repro’] no Stable report discriminator for one Buildish JSON report contract.
verify_rc_report_schema_version SchemaVersionV1 yes Schema version of the verify-rc JSON report that inspect-repro read before generating its own output.
bundle_schema_version SchemaVersionV1 no Supported schema version of the retained inspection-bundle manifest that inspect-repro consumed.
component_id str no Stable component identifier used across Buildish manifests, reports, and release-state records.
rc_tag str no Exact RC Git tag, including the leading v prefix and -rcN suffix.
verify_rc_verdict VerificationVerdict yes Final verify-rc verdict that inspect-repro observed in the input verification report.
build_checks_attempted bool yes Whether the command attempted local reproducibility or rebuild checks during this run.
report_json_path NonEmptyString yes Filesystem path of the verify-rc JSON report consumed by inspect-repro.
inspection_bundle_path NonEmptyString yes Filesystem path of the retained inspection bundle directory.
selected_artifact_ids list[NonEmptyString] no Artifact ids that inspect-repro selected for detailed output.
selected_failure_classes list[NonEmptyString] no Failure-class filters that inspect-repro applied when selecting targets.
summary_only bool no Whether inspect-repro emitted only grouped summaries rather than full per-target detail sections.
summary InspectReproSummaryV1 yes Human-readable short summary for the related result or mocked tool behavior.
targets list[InspectReproTargetV1] no Selected inspect-repro target entries that Buildish included in the machine-readable report.

InspectReproSummaryV1

Top-level summary block for machine-readable inspect-repro output.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
failure_count int yes Total number of failing source or secondary reproducibility targets selected for inspect-repro output.
source_failure_count int yes Number of failing source-artifact reproducibility targets selected for inspect-repro output.
secondary_failure_count int yes Number of failing secondary-artifact reproducibility targets selected for inspect-repro output.
failure_kinds list[InspectReproCountSummary] no Count summary grouped by artifact kind across all selected inspect-repro targets.
failure_classes list[InspectReproCountSummary] no Count summary grouped by failure-class identifier across all selected inspect-repro targets.
failure_groups list[InspectReproCountSummary] no Count summary grouped by high-level inspect-repro failure group.

InspectReproTargetV1

One selected reproducibility failure reported by inspect-repro JSON mode.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
section_label NonEmptyString yes Human-facing section label that groups related inspect-repro targets.
artifact_id NonEmptyString yes Stable identifier for one source, secondary, or emitted artifact within Buildish release tooling.
kind NonEmptyString yes Declared artifact or report kind discriminator.
failure_class NonEmptyString no Structured failure classification that summarizes the main reason why verification or reproducibility failed.
failure_group NonEmptyString yes Higher-level grouping bucket that inspect-repro assigned to the target, such as source-artifact or secondary artifact family.
profile_id NonEmptyString yes Reproducibility profile identifier selected for the related artifact or source verification.
comparison_mode NonEmptyString yes Declared reproducibility comparison mode used for the related artifact or profile.
recipe_source Literal[‘verifier-internal’, ‘canonical-profile’, ’local-override’] yes Origin of the reproducibility recipe used for this target, such as verifier-internal logic, the canonical profile, or a local override.
execution_backend NonEmptyString no Execution backend that verify-rc used for the recorded reproducibility run.
build_command list[NonEmptyString] no Literal argv list that inspect-repro or verify-rc recorded as the effective build command for this target.
build_working_directory NonEmptyString no Repository-root-relative working directory that inspect-repro or verify-rc recorded for the effective build command.
injected_environment_keys list[NonEmptyString] no Environment variable names that Buildish injected into the effective rebuild subprocess.
evidence_labels list[NonEmptyString] no Short labels naming the retained evidence files that inspect-repro associated with this target.
evidence list[InspectionEvidenceReference] no Inspection-bundle evidence references retained for one reproducibility result.
override_fields list[NonEmptyString] no Sparse list of build-recipe fields that a local reproducibility override changed for this target.

InspectionBundleArtifactEntry

One artifact-specific metadata document retained inside an inspection bundle.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
artifact_id NonEmptyString yes Stable identifier for one source, secondary, or emitted artifact within Buildish release tooling.
kind NonEmptyString yes Declared artifact or report kind discriminator.
metadata_path NonEmptyString yes Bundle-relative path to the metadata file for one retained inspection target.

InspectionBundleManifestV1

Top-level contract manifest for one curated verify-rc inspection bundle.

Field Type Required Description
schema_version SchemaVersionV1 no Schema version of the enclosing Buildish JSON or YAML contract.
bundle_type Literal[‘verify-rc-inspection’] no Stable inspection-bundle manifest discriminator.
report_type Literal[‘verify-rc’] no Stable report discriminator for one Buildish JSON report contract.
report_schema_version SchemaVersionV1 no Supported schema version of the related Buildish report payload.
component_id str no Stable component identifier used across Buildish manifests, reports, and release-state records.
version str no Release version string without a leading v prefix.
rc_tag str no Exact RC Git tag, including the leading v prefix and -rcN suffix.
artifacts list[InspectionBundleArtifactEntry] no Artifact entries retained in the related inspection bundle manifest.

InspectionBundleSection

Location of the curated reproducibility-inspection bundle for one verify-rc run.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
relative_path_from_report NonEmptyString yes Path from the verify-rc report directory to the retained inspection bundle directory.
bundle_schema_version SchemaVersionV1 no Supported schema version of the retained inspection-bundle manifest that inspect-repro consumed.
manifest_relative_path NonEmptyString no Bundle-relative path to the top-level inspection bundle manifest file.

InspectionEvidenceReference

One retained evidence file inside the verify-rc inspection bundle.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
label NonEmptyString yes Human-readable label used to name one evidence file or report section.
path NonEmptyString yes Filesystem path, relative artifact path, or retained evidence path associated with the related record.

IntegrityVerificationReport

Observed integrity verification results for one npm package.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
algorithm Literal[‘sha256’, ‘sha512’] no Checksum or digest algorithm name that Buildish used for the related verification or report entry.
value str no Declared checksum or digest value recorded in the related payload.
matches_manifest_checksum bool no Whether the resolved checksum value matched the checksum declared in the signed manifest.
matches_downloaded_bytes bool no Whether the checksum or integrity value matched the bytes that Buildish actually downloaded.

InvalidSecondaryArtifactVerificationReport

Failure record used when one secondary artifact entry is malformed.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
artifact_id NonEmptyString yes Stable identifier for one source, secondary, or emitted artifact within Buildish release tooling.
kind Literal[’_invalid-secondary-artifact-entry’] no Declared artifact or report kind discriminator.
declared_kind str no Artifact kind string declared by the malformed secondary-artifact entry that verify-rc could not process normally.
verdict Literal[‘failed’] no Structured verification or reproducibility verdict for the related subject.
issues list[str] no Collected human-readable issues observed for the related verification, inspection, or reproducibility subject.

InventoryVerificationReport

Verification results for one downloaded inventory attachment.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
filename NonEmptyString yes Artifact filename as seen in staging, manifests, or retained evidence.
uri NonEmptyString yes Canonical artifact or signature URI recorded in a Buildish manifest or verification report.
sha512 Sha512Hex yes SHA-512 checksum payload associated with the related artifact.
entry_count int no Number of entries recorded in the related inventory, repository snapshot, or artifact collection.
total_size_bytes int no Total size, in bytes, recorded for the related artifact collection or inventory.

LiveMavenRepositoryReport

Observed live-repository comparison results for a Maven staging repository.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
entry_count int no Number of entries recorded in the related inventory, repository snapshot, or artifact collection.
total_size_bytes int yes Total size, in bytes, recorded for the related artifact collection or inventory.
matches_signed_inventory bool yes Whether the live staged Maven repository contents matched the signed inventory metadata.
signature_verifications list[LiveRepositorySignatureVerification] no Detached-signature verification results collected for live Maven repository sidecars.

LiveRepositorySignatureVerification

One detached signature verified in the live Maven repository.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
path NonEmptyString yes Filesystem path, relative artifact path, or retained evidence path associated with the related record.
target_path NonEmptyString yes Target path that the related detached signature or copy operation refers to.
signature SignatureVerificationPayload yes Signature verification details for the related artifact or manifest.

ManifestVerificationSection

Manifest-authenticity and tag-binding section of the verify-rc report.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
verdict VerificationVerdict yes Structured verification or reproducibility verdict for the related subject.
sha512 str no SHA-512 checksum payload associated with the related artifact.
keys_url_matches_manifest bool yes Whether the verified KEYS URL matched the authoritative manifest’s own recorded KEYS URL.
keys_url_matches_component_config bool no Whether the manifest’s KEYS URL matched the current component configuration.
signature SignatureVerificationPayload no Signature verification details for the related artifact or manifest.
rc_tag_target_commit str no Git commit SHA that the RC tag resolved to during verification or publication.
rc_tag_matches_source_commit_sha bool yes Whether the RC tag resolved to the same commit SHA that the manifest recorded as the authoritative source commit.
issues list[str] no Collected human-readable issues observed for the related verification, inspection, or reproducibility subject.

MavenRepositoryInventoryEntry

One file entry in a signed Maven repository inventory.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
path NonEmptyString yes Filesystem path, relative artifact path, or retained evidence path associated with the related record.
size_bytes int yes Byte size recorded for the related artifact, retained snapshot, or inventory entry.
sha512 Sha512Hex yes SHA-512 checksum payload associated with the related artifact.

MavenRepositoryInventoryV1

A signed Maven repository inventory attachment.

Field Type Required Description
schema_version SchemaVersionV1 no Schema version of the enclosing Buildish JSON or YAML contract.
inventory_type Literal[‘maven-repository’] no Stable manifest discriminator for the signed Maven repository inventory file.
artifact_id NonEmptyString yes Stable identifier for one source, secondary, or emitted artifact within Buildish release tooling.
staging_repository_id NonEmptyString yes Repository identifier of the staged Maven repository under verification.
base_url NonEmptyString yes Base URL used to discover or publish the related artifact or service resource.
entries list[MavenRepositoryInventoryEntry] yes Typed entries recorded in the related manifest, inventory, or report payload.

MavenRepositoryPathResultReport

One comparable staged Maven repository path result retained for inspection.

Field Type Required Description
path NonEmptyString yes Filesystem path, relative artifact path, or retained evidence path associated with the related record.
mode MavenRepositoryPathMode yes Comparison mode that Buildish applied when comparing this staged Maven repository path to the rebuilt local path.
verdict MavenRepositoryPathVerdict yes Structured verification or reproducibility verdict for the related subject.
detail NonEmptyString yes Human-readable comparison detail for one verification or reproducibility result entry.
raw_bytes_equal bool no Whether raw staged and rebuilt bytes matched before any archive-aware normalization.
normalized_match bool no Whether the staged and rebuilt repository path matched after applying the selected normalization mode.
staged_sha512 Sha512Hex no SHA-512 digest computed from the staged repository entry or retained artifact bytes.
rebuilt_sha512 Sha512Hex no SHA-512 digest computed from the rebuilt source or secondary artifact bytes.

MavenRepositoryPathRuleReport

One regex-based Maven repository path rule retained for inspection.

Field Type Required Description
pattern NonEmptyString yes Regular-expression pattern used to match one family of repository paths.
mode MavenRepositoryPathMode yes Comparison mode that the associated regex path rule applies to matching staged Maven repository paths.

MavenRepositoryReproducibilityMetadata

Retained comparison metadata for one Maven repository reproducibility run.

Field Type Required Description
artifact_id NonEmptyString yes Stable identifier for one source, secondary, or emitted artifact within Buildish release tooling.
kind Literal[‘maven-repository’] no Declared artifact or report kind discriminator.
profile_id NonEmptyString yes Reproducibility profile identifier selected for the related artifact or source verification.
comparison_mode Literal[‘repository-tree’] no Declared reproducibility comparison mode used for the related artifact or profile.
canonical_recipe ArtifactReproducibilityCanonicalRecipeReport no Canonical rebuild recipe resolved from the verified source tree or other authoritative Buildish configuration.
effective_execution ArtifactReproducibilityEffectiveExecutionReport no Effective build execution details that Buildish actually ran after applying local overrides or runtime defaults.
override ArtifactReproducibilityOverrideReport no Explicit local reproducibility override details applied on top of the canonical recipe.
repository_dir NonEmptyString no Repository-root-relative rebuild output directory that should contain the local Maven repository tree.
require_signatures bool no Whether Maven repository reproducibility should require detached signature files to exist and compare successfully.
path_rules list[MavenRepositoryPathRuleReport] no Regex-based per-path comparison rules that specialize the default Maven repository comparison behavior.
matches_remote_bytes bool no Whether the rebuilt artifact bytes matched the staged or signed remote bytes exactly.
failure_class NonEmptyString no Structured failure classification that summarizes the main reason why verification or reproducibility failed.
verified_path_count int no Number of Maven repository paths that Buildish compared locally under the active repository-tree policy.
failed_path_count int no Number of Maven repository paths whose reproducibility comparison ended in a failure state.
skipped_path_count int no Number of Maven repository paths that Buildish skipped from local comparison because policy marked them remote-only.
path_results list[MavenRepositoryPathResultReport] no Per-path Maven repository reproducibility results retained for later inspection or reporting.
issues list[str] no Collected human-readable issues observed for the related verification, inspection, or reproducibility subject.

MavenRepositorySecondaryArtifact

A staged Maven repository validated through a signed inventory.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
artifact_id object yes Stable identifier for one source, secondary, or emitted artifact within Buildish release tooling.
kind Literal[‘maven-repository’] no Declared artifact or report kind discriminator.
role object no Artifact role within the RC manifest, such as source artifact, vote-manifest supplement, or convenience artifact.
artifact_origin object no Origin classification describing whether the artifact came from a source build, registry, or repository staging area.
git_commit_sha object no Git commit SHA recorded for the related artifact, manifest, or provenance block.
reproducibility object no Reproducibility policy or result block associated with the related source or secondary artifact.
inventory SupplementalInventoryReference yes Signed inventory or supplemental staging metadata associated with the related artifact.
staging_repository_id NonEmptyString yes Repository identifier of the staged Maven repository under verification.
base_url NonEmptyString yes Base URL used to discover or publish the related artifact or service resource.

MavenRepositoryVerificationReport

Verification report for one staged Maven repository.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
artifact_id NonEmptyString yes Stable identifier for one source, secondary, or emitted artifact within Buildish release tooling.
kind Literal[‘maven-repository’] no Declared artifact or report kind discriminator.
verdict VerificationVerdict yes Structured verification or reproducibility verdict for the related subject.
issues list[str] no Collected human-readable issues observed for the related verification, inspection, or reproducibility subject.
staging_repository_id NonEmptyString yes Repository identifier of the staged Maven repository under verification.
base_url NonEmptyString yes Base URL used to discover or publish the related artifact or service resource.
inventory InventoryVerificationReport no Signed inventory or supplemental staging metadata associated with the related artifact.
live_repository LiveMavenRepositoryReport yes Live staged Maven repository verification details collected alongside the signed inventory checks.
reproducibility ArtifactReproducibilityReport no Reproducibility policy or result block associated with the related source or secondary artifact.

NpmChecksums

A checksum block for npm artifacts, which may use sha256 or sha512.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
sha256 Sha256ChecksumPayload no SHA-256 checksum payload associated with the related artifact.
sha512 Sha512ChecksumPayload no SHA-512 checksum payload associated with the related artifact.

NpmPackageSecondaryArtifact

A published npm package tarball.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
artifact_id object yes Stable identifier for one source, secondary, or emitted artifact within Buildish release tooling.
kind Literal[’npm-package’] no Declared artifact or report kind discriminator.
role object no Artifact role within the RC manifest, such as source artifact, vote-manifest supplement, or convenience artifact.
artifact_origin object no Origin classification describing whether the artifact came from a source build, registry, or repository staging area.
git_commit_sha object no Git commit SHA recorded for the related artifact, manifest, or provenance block.
reproducibility object no Reproducibility policy or result block associated with the related source or secondary artifact.
inventory object no Signed inventory or supplemental staging metadata associated with the related artifact.
filename NonEmptyString yes Artifact filename as seen in staging, manifests, or retained evidence.
uri NonEmptyString yes Canonical artifact or signature URI recorded in a Buildish manifest or verification report.
registry_url NonEmptyString yes Registry metadata URL used for npm package verification.
package_name NonEmptyString yes Normalized npm package name associated with the related package artifact or registry lookup.
version NonEmptyString yes Release version string without a leading v prefix.
integrity NonEmptyString yes Integrity verification details derived from registry metadata or sidecar checksums.
checksums NpmChecksums yes Declared checksum sidecars or signed checksum values associated with this artifact.
authenticity NpmProvenanceAuth no Authenticity metadata, such as provenance or attestation references, associated with the related package artifact.

NpmPackageVerificationReport

Verification report for one npm package.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
artifact_id NonEmptyString yes Stable identifier for one source, secondary, or emitted artifact within Buildish release tooling.
kind Literal[’npm-package’] no Declared artifact or report kind discriminator.
verdict VerificationVerdict yes Structured verification or reproducibility verdict for the related subject.
issues list[str] no Collected human-readable issues observed for the related verification, inspection, or reproducibility subject.
filename NonEmptyString yes Artifact filename as seen in staging, manifests, or retained evidence.
uri NonEmptyString yes Canonical artifact or signature URI recorded in a Buildish manifest or verification report.
registry_url NonEmptyString yes Registry metadata URL used for npm package verification.
package_name NonEmptyString yes Normalized npm package name associated with the related package artifact or registry lookup.
version NonEmptyString yes Release version string without a leading v prefix.
integrity IntegrityVerificationReport yes Integrity verification details derived from registry metadata or sidecar checksums.
checksum ChecksumVerificationReport yes Checksum verification details for one downloaded or rebuilt artifact.
registry_resolution NpmRegistryResolutionReport yes Registry-resolution details collected while verifying the related npm package tarball.
reproducibility ArtifactReproducibilityReport no Reproducibility policy or result block associated with the related source or secondary artifact.

NpmProvenanceAuth

Explicit npm provenance metadata.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
scheme Literal[’npm-provenance’] no Stable scheme identifier that names the authenticity or provenance mechanism represented by the related payload.
repository NonEmptyString yes Repository identifier or repository name associated with the related provenance or external-auth record.

NpmRegistryResolutionReport

Resolution details for one npm registry lookup.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
metadata_url str no Registry metadata URL that Buildish fetched while resolving npm package verification data.
found_via str no Short note describing how the related package URL or artifact metadata was discovered during verification.
tarball_url_matches_manifest bool no Whether the tarball URL resolved from the npm registry metadata matched the URL declared in the signed manifest.
integrity_matches_manifest bool no Whether the integrity string or digest resolved from the registry matched the value declared in the signed manifest.
signatures_count int yes Number of signature records or provenance signatures that the registry metadata exposed for the related npm package artifact.

OciImageReproducibilityMetadata

Retained comparison metadata for one OCI image reproducibility run.

Field Type Required Description
artifact_id NonEmptyString yes Stable identifier for one source, secondary, or emitted artifact within Buildish release tooling.
kind Literal[‘oci-image’] no Declared artifact or report kind discriminator.
profile_id NonEmptyString yes Reproducibility profile identifier selected for the related artifact or source verification.
comparison_mode Literal[‘platform-digest’, ‘provenance-only’] yes Declared reproducibility comparison mode used for the related artifact or profile.
canonical_recipe ArtifactReproducibilityCanonicalRecipeReport no Canonical rebuild recipe resolved from the verified source tree or other authoritative Buildish configuration.
effective_execution ArtifactReproducibilityEffectiveExecutionReport no Effective build execution details that Buildish actually ran after applying local overrides or runtime defaults.
override ArtifactReproducibilityOverrideReport no Explicit local reproducibility override details applied on top of the canonical recipe.
image_ref NonEmptyString no Fully qualified OCI image reference used for inspection or local rebuild comparison.
declared_digest OciContentDigest yes Signed or declared digest that the rebuilt value is compared against.
expected_platform_digests list[OciPlatformDigest] no Platform-specific OCI digests that the reproducibility check expected to reproduce for the rebuilt image.
rebuilt_digest OciContentDigest no Digest produced by rebuilding the related OCI image locally.
rebuilt_platform_digests list[OciPlatformDigest] no Platform digests produced by rebuilding the related multi-platform OCI image.
matches_remote_bytes bool no Whether the rebuilt artifact bytes matched the staged or signed remote bytes exactly.
failure_class NonEmptyString no Structured failure classification that summarizes the main reason why verification or reproducibility failed.
issues list[str] no Collected human-readable issues observed for the related verification, inspection, or reproducibility subject.

OciImageSecondaryArtifact

An immutable OCI image reference.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
artifact_id object yes Stable identifier for one source, secondary, or emitted artifact within Buildish release tooling.
kind Literal[‘oci-image’] no Declared artifact or report kind discriminator.
role object no Artifact role within the RC manifest, such as source artifact, vote-manifest supplement, or convenience artifact.
artifact_origin object no Origin classification describing whether the artifact came from a source build, registry, or repository staging area.
git_commit_sha object no Git commit SHA recorded for the related artifact, manifest, or provenance block.
reproducibility object no Reproducibility policy or result block associated with the related source or secondary artifact.
inventory object no Signed inventory or supplemental staging metadata associated with the related artifact.
uri NonEmptyString yes Canonical artifact or signature URI recorded in a Buildish manifest or verification report.
registry NonEmptyString yes Container registry host or namespace that serves the related OCI image.
repository NonEmptyString yes Repository identifier or repository name associated with the related provenance or external-auth record.
digest OciContentDigest yes OCI content digest or similar immutable digest string for the related artifact.
platform_digests list[OciPlatformDigest] no Per-platform OCI digests declared or observed for a multi-platform image.

OciImageVerificationReport

Verification report for one OCI image.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
artifact_id NonEmptyString yes Stable identifier for one source, secondary, or emitted artifact within Buildish release tooling.
kind Literal[‘oci-image’] no Declared artifact or report kind discriminator.
verdict VerificationVerdict yes Structured verification or reproducibility verdict for the related subject.
issues list[str] no Collected human-readable issues observed for the related verification, inspection, or reproducibility subject.
uri NonEmptyString yes Canonical artifact or signature URI recorded in a Buildish manifest or verification report.
registry NonEmptyString yes Container registry host or namespace that serves the related OCI image.
repository NonEmptyString yes Repository identifier or repository name associated with the related provenance or external-auth record.
digest OciContentDigest yes OCI content digest or similar immutable digest string for the related artifact.
inspection OciInspectionReport yes Live inspection result block for the related artifact or platform resource.
reproducibility ArtifactReproducibilityReport no Reproducibility policy or result block associated with the related source or secondary artifact.

OciInspectionReport

Observed registry inspection results for one OCI image.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
image_ref NonEmptyString yes Fully qualified OCI image reference used for inspection or local rebuild comparison.
digest_matches_manifest bool yes Whether the inspected OCI image digest matched the digest declared in the signed manifest.
platform_digests_match bool no Whether all inspected OCI platform digests matched the platform digests declared in the signed manifest.
platform_digests list[OciPlatformDigest] no Per-platform OCI digests declared or observed for a multi-platform image.

OciPlatformDigest

One platform-specific digest declared for an OCI image.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
platform NonEmptyString yes OCI platform identifier in os/arch[/variant] form.
digest OciContentDigest yes OCI content digest or similar immutable digest string for the related artifact.

PyPiAttestationAuth

Explicit PyPI attestation metadata.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
scheme Literal[‘pypi-attestation’] no Stable scheme identifier that names the authenticity or provenance mechanism represented by the related payload.
repository NonEmptyString yes Repository identifier or repository name associated with the related provenance or external-auth record.

PythonDistributionSecondaryArtifact

A published Python distribution file.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
artifact_id object yes Stable identifier for one source, secondary, or emitted artifact within Buildish release tooling.
kind Literal[‘python-distribution’] no Declared artifact or report kind discriminator.
role object no Artifact role within the RC manifest, such as source artifact, vote-manifest supplement, or convenience artifact.
artifact_origin object no Origin classification describing whether the artifact came from a source build, registry, or repository staging area.
git_commit_sha object no Git commit SHA recorded for the related artifact, manifest, or provenance block.
reproducibility object no Reproducibility policy or result block associated with the related source or secondary artifact.
inventory object no Signed inventory or supplemental staging metadata associated with the related artifact.
filename NonEmptyString yes Artifact filename as seen in staging, manifests, or retained evidence.
uri NonEmptyString yes Canonical artifact or signature URI recorded in a Buildish manifest or verification report.
index_url NonEmptyString yes Base Python simple-index URL that Buildish used for package verification.
project_name NonEmptyString yes Python package project name associated with the related distribution artifact.
version NonEmptyString yes Release version string without a leading v prefix.
checksums Sha256Checksums yes Declared checksum sidecars or signed checksum values associated with this artifact.
authenticity PyPiAttestationAuth no Authenticity metadata, such as provenance or attestation references, associated with the related package artifact.

PythonDistributionVerificationReport

Verification report for one Python distribution.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
artifact_id NonEmptyString yes Stable identifier for one source, secondary, or emitted artifact within Buildish release tooling.
kind Literal[‘python-distribution’] no Declared artifact or report kind discriminator.
verdict VerificationVerdict yes Structured verification or reproducibility verdict for the related subject.
issues list[str] no Collected human-readable issues observed for the related verification, inspection, or reproducibility subject.
filename NonEmptyString yes Artifact filename as seen in staging, manifests, or retained evidence.
uri NonEmptyString yes Canonical artifact or signature URI recorded in a Buildish manifest or verification report.
index_url NonEmptyString yes Base Python simple-index URL that Buildish used for package verification.
project_name NonEmptyString yes Python package project name associated with the related distribution artifact.
version NonEmptyString yes Release version string without a leading v prefix.
checksum ChecksumVerificationReport yes Checksum verification details for one downloaded or rebuilt artifact.
index_resolution PythonIndexResolutionReport yes Python package-index resolution details collected while locating the staged distribution artifact.
reproducibility ArtifactReproducibilityReport no Reproducibility policy or result block associated with the related source or secondary artifact.

PythonIndexResolutionReport

Resolution details for one Python simple-index lookup.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
project_index_url NonEmptyString yes Resolved Python simple-index page URL that Buildish used to discover the expected distribution artifact.
resolved_url str no Resolved direct distribution or tarball URL that Buildish selected from the related package index.
found_via str no Short note describing how the related package URL or artifact metadata was discovered during verification.
sha256_matches_index bool no Whether the distribution hash from the Python simple index matched the digest declared in the signed manifest.

RebuiltOutputSnapshot

One rebuilt output file described inside an inspection-bundle metadata document.

Field Type Required Description
path NonEmptyString yes Filesystem path, relative artifact path, or retained evidence path associated with the related record.
sha512 Sha512Hex yes SHA-512 checksum payload associated with the related artifact.
size_bytes int yes Byte size recorded for the related artifact, retained snapshot, or inventory entry.

ReproducibilityExecutionSection

Run-level policy and execution summary for build-based reproducibility checks.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
requested_mode Literal[‘auto’, ‘integrity-only’, ‘full’] yes Verify-rc mode explicitly requested by the caller.
effective_mode Literal[‘integrity-only’, ‘full’] yes Verify mode that Buildish actually executed after evaluating prompts, runtime policy, and caller intent.
build_checks_attempted bool yes Whether the command attempted local reproducibility or rebuild checks during this run.
execution_backend Literal[’none’, ‘host-direct’] no Execution backend that verify-rc used for the recorded reproducibility run.
inherits_host_home bool no Whether the reproducibility execution inherited the caller’s existing HOME rather than using an isolated home directory.
prompt_used bool no Whether Buildish prompted before enabling the recorded reproducibility execution mode.
prompt_confirmed bool no Whether the caller confirmed a prompt before Buildish escalated from integrity-only verification to full local rebuild checks.
skipped_reason str no Reason why Buildish skipped local rebuild execution after evaluating the requested verify mode and runtime constraints.

ReproducibilitySelector

Signed manifest selector for one canonical local reproducibility profile.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
profile_id NonEmptyString yes Reproducibility profile identifier selected for the related artifact or source verification.

RetainedArtifactSnapshot

One retained file snapshot described inside an inspection-bundle metadata document.

Field Type Required Description
filename NonEmptyString yes Artifact filename as seen in staging, manifests, or retained evidence.
sha512 Sha512Hex yes SHA-512 checksum payload associated with the related artifact.
size_bytes int yes Byte size recorded for the related artifact, retained snapshot, or inventory entry.

SecondaryArtifactBase

Common fields shared across supported secondary artifact kinds.

Field Type Required Description
artifact_id NonEmptyString yes Stable identifier for one source, secondary, or emitted artifact within Buildish release tooling.
kind str yes Declared artifact or report kind discriminator.
role NonEmptyString no Artifact role within the RC manifest, such as source artifact, vote-manifest supplement, or convenience artifact.
artifact_origin NonEmptyString no Origin classification describing whether the artifact came from a source build, registry, or repository staging area.
git_commit_sha GitCommitSha no Git commit SHA recorded for the related artifact, manifest, or provenance block.
reproducibility ReproducibilitySelector no Reproducibility policy or result block associated with the related source or secondary artifact.
inventory SupplementalInventoryReference no Signed inventory or supplemental staging metadata associated with the related artifact.

SecondaryArtifactManifestV1

A reusable secondary-artifact manifest fragment.

Field Type Required Description
secondary_artifacts list[AnySecondaryArtifact] yes Declared secondary artifacts retained in the RC vote manifest or secondary-artifact manifest.

Sha256ChecksumPayload

One sha256 checksum value and optional detached sidecar URI.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
value Sha256Hex yes Declared checksum or digest value recorded in the related payload.
uri NonEmptyString no Canonical artifact or signature URI recorded in a Buildish manifest or verification report.

Sha256Checksums

A checksum block containing one sha256 entry.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
sha256 Sha256ChecksumPayload yes SHA-256 checksum payload associated with the related artifact.

Sha512ChecksumPayload

One sha512 checksum value and optional detached sidecar URI.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
value Sha512Hex yes Declared checksum or digest value recorded in the related payload.
uri NonEmptyString no Canonical artifact or signature URI recorded in a Buildish manifest or verification report.

Sha512Checksums

A checksum block containing one sha512 entry.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
sha512 Sha512ChecksumPayload yes SHA-512 checksum payload associated with the related artifact.

ShallowArchiveAnalysisReport

Durable shallow archive-comparison findings for one retained artifact pair.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
classification NonEmptyString yes High-level shallow-comparison classification that summarizes the most important archive drift pattern Buildish observed.
raw_bytes_equal bool yes Whether raw staged and rebuilt bytes matched before any archive-aware normalization.
archive_format Literal[’tar’, ‘zip’] no Detected top-level archive format of the compared artifact when shallow archive inspection succeeded.
staged_archive_format ArchiveAnalysisFormat yes Detected top-level archive format of the staged artifact retained for shallow archive inspection.
rebuilt_archive_format ArchiveAnalysisFormat yes Detected top-level archive format of the rebuilt artifact retained for shallow archive inspection.
staged_entry_count int no Number of top-level archive entries found in the staged artifact during shallow inspection.
rebuilt_entry_count int no Number of top-level archive entries found in the rebuilt artifact during shallow inspection.
missing_paths list[NonEmptyString] no Archive or repository paths that were present in the staged artifact but missing from the rebuilt artifact.
unexpected_paths list[NonEmptyString] no Archive or repository paths that were present only in the rebuilt artifact and not in the staged artifact.
entry_order_mismatches list[NonEmptyString] no Archive-entry ordering differences detected between the staged and rebuilt artifacts during shallow comparison.
metadata_mismatches list[NonEmptyString] no Archive-entry metadata differences, such as timestamps, modes, owners, or file-type drift, found during shallow comparison.
content_mismatches list[NonEmptyString] no Archive member paths whose direct top-level content bytes differed between the staged and rebuilt artifacts during shallow comparison.

SignatureReference

One detached OpenPGP signature reference.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
type Literal[‘openpgp-detached-ascii-armored’] no Stable subtype discriminator or signature-reference type for the related payload.
uri NonEmptyString yes Canonical artifact or signature URI recorded in a Buildish manifest or verification report.

SignatureVerificationPayload

Serialized detached-signature verification details.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
signer_fingerprint NonEmptyString yes OpenPGP fingerprint of the key that verified the related detached signature.
signer_user_id str no Primary user id string reported by GnuPG for the key that verified the related detached signature.
trust_label str no Human-readable GnuPG trust label returned by signature verification.
key_algorithm str no Public-key algorithm reported for the signing key that verified the related detached signature.
key_size_bits int no Public-key size, in bits, reported for the signing key that verified the related detached signature.

SourceArtifactReproducibilityMetadata

Retained comparison metadata for source-artifact reproducibility inspection.

Field Type Required Description
profile_id NonEmptyString yes Reproducibility profile identifier selected for the related artifact or source verification.
comparison_mode NonEmptyString yes Declared reproducibility comparison mode used for the related artifact or profile.
failure_class NonEmptyString no Structured failure classification that summarizes the main reason why verification or reproducibility failed.
archive_analysis ShallowArchiveAnalysisReport no Shallow top-level archive comparison details retained for reproducibility inspection.
staged_artifact RetainedArtifactSnapshot yes Retained snapshot metadata for the staged artifact bytes used as the comparison target.
rebuilt_artifact RetainedArtifactSnapshot no Retained snapshot metadata for one rebuilt artifact copy in the inspection bundle.
matches_remote_bytes bool no Whether the rebuilt artifact bytes matched the staged or signed remote bytes exactly.
issues list[str] no Collected human-readable issues observed for the related verification, inspection, or reproducibility subject.

SourceArtifactVerificationSection

Source-artifact verification section of the verify-rc report.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
verdict VerificationVerdict yes Structured verification or reproducibility verdict for the related subject.
filename str no Artifact filename as seen in staging, manifests, or retained evidence.
uri str no Canonical artifact or signature URI recorded in a Buildish manifest or verification report.
sha512 str no SHA-512 checksum payload associated with the related artifact.
sha512_sidecar_verified bool yes Whether the staged source-artifact .sha512 sidecar was fetched and verified successfully.
signature SignatureVerificationPayload no Signature verification details for the related artifact or manifest.
rebuilt_sha512 str no SHA-512 digest computed from the rebuilt source or secondary artifact bytes.
matches_source_commit_sha bool yes Whether the rebuilt source artifact bytes matched the source commit selected by the authoritative manifest.
reproducibility ArtifactReproducibilityReport no Reproducibility policy or result block associated with the related source or secondary artifact.
issues list[str] no Collected human-readable issues observed for the related verification, inspection, or reproducibility subject.

SupplementalInventoryReference

One staged supplemental inventory attachment.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
filename NonEmptyString yes Artifact filename as seen in staging, manifests, or retained evidence.
sha512 Sha512Hex yes SHA-512 checksum payload associated with the related artifact.
uri NonEmptyString no Canonical artifact or signature URI recorded in a Buildish manifest or verification report.
entry_count int no Number of entries recorded in the related inventory, repository snapshot, or artifact collection.
total_size_bytes int no Total size, in bytes, recorded for the related artifact collection or inventory.

VerificationFailurePayload

One collected verification failure.

  • category: emitted
  • ownership: tooling-derived
  • file contract: (inner type)
Field Type Required Description
scope NonEmptyString yes Machine-readable scope label that identifies which verification surface produced the related failure record.
subject NonEmptyString yes Human-facing verification failure subject that identifies what failed.
message NonEmptyString yes Human-readable message body associated with the related verification failure, harness tag object, or fixture definition.

VerifyRcReportV1

Machine-readable Phase 1a RC verification report.

  • category: emitted
  • ownership: tooling-derived
  • schema file: verify-rc-report-v1.schema.json
  • audience: supported
  • stability: stable
  • file contract: (inner type)
Field Type Required Description
schema_version SchemaVersionV1 no Schema version of the enclosing Buildish JSON or YAML contract.
report_type Literal[‘verify-rc’] no Stable report discriminator for one Buildish JSON report contract.
component_id str no Stable component identifier used across Buildish manifests, reports, and release-state records.
version str no Release version string without a leading v prefix.
rc_tag str no Exact RC Git tag, including the leading v prefix and -rcN suffix.
source_commit_sha str no Resolved source Git commit SHA recorded in the authoritative RC manifest or verify-rc report.
source_date_epoch int no Canonical SOURCE_DATE_EPOCH integer carried through RC production and verification.
source_repository_url str no Canonical source repository URL recorded in the RC vote manifest or verification report.
manifest_url NonEmptyString yes URL of the RC vote manifest that Buildish fetched or verified.
keys_url NonEmptyString yes ASF KEYS URL that Buildish used or expected while establishing the RC trust roots.
verdict VerificationVerdict yes Structured verification or reproducibility verdict for the related subject.
work_dir NonEmptyString yes Filesystem path of the verify-rc working directory where retained reports, logs, and downloaded artifacts were stored.
failures list[VerificationFailurePayload] no Collected verification failures that caused the enclosing report verdict to fail.
manifest_verification ManifestVerificationSection yes Manifest trust-chain verification section of the verify-rc report.
source_artifact_verification SourceArtifactVerificationSection yes Source-artifact verification section of the verify-rc report.
reproducibility_execution ReproducibilityExecutionSection yes Run-level reproducibility execution policy and outcome block retained in the verify-rc report.
inspection_bundle InspectionBundleSection no Inspection-bundle location block retained in the verify-rc report for later inspect-repro analysis.
secondary_artifact_verifications list[AnySecondaryArtifactVerification] no Per-artifact verification sections for all secondary artifacts processed during verify-rc.