# Provenance fixtures

The bundle is the public Sigstore SLSA provenance for `@sigstore/core@4.0.1`, generated by `actions/attest-build-provenance` from `sigstore/sigstore-js` commit `d406ea60b342ca37cdeecd7afedb992cd189db92` and `.github/workflows/release.yml`.

The v1 verifier intentionally supports the proved same-repository workflow model: the attested workflow repository, release `sourceRepository`, and signed profile repository must all agree. Reusable workflows hosted in a different repository are not supported.

- Bundle source: `https://registry.npmjs.org/-/npm/v1/attestations/@sigstore%2fcore@4.0.1`
- Artifact source: `https://registry.npmjs.org/@sigstore/core/-/core-4.0.1.tgz`
- Bundle file SHA-256: `0f9609cf665d761909b505295389bb73c90a42659b407573cb467b5dd52b9958`
- Artifact SHA-256: `8cc190e4385ee18399950148723aecd8db6e835668c361e4b6014435ba202643`
- Artifact SHA-512: `f6fe61463ba39f9357abca3b5c511480bc80b5daf9222b1be29cccd39bb72bad484b9ab784fde5b96027764d1190f3cb4d41684db83b55bf38510d5941e6a359`

`packages/registry-verification/src/trust-roots/sigstore-public-good-v1.json` is the reviewed public-good subset of `gh attestation trusted-root` fetched on 2026-07-11. The source command output had SHA-256 `65ca537f6ed8a47fd0e560c421baa1f6c1efb8b25fc200d8c5c02c0e92eb2b9c`; the formatted, filtered vendored root has SHA-256 `8a1bf665f1544d4bb57963e15b3207020e602c1e9cd12730e641b1d0185be2bf`. GitHub-private Fulcio and TSA authorities are deliberately excluded.

## Trust-root updates

Trust roots are immutable, versioned source files and are never fetched at runtime. To refresh them, obtain the current public root, remove non-public trust domains, add a new `sigstore-public-good-vN.json`, and review every added, removed, or changed key, service URL, key algorithm, and validity window. Verify the shared Node/workerd corpus before changing the verifier to the new version. Retain prior public CAs, logs, CT logs, and timestamp authorities while they are needed to validate signatures produced during their validity periods. Record the source date and both source and vendored SHA-256 hashes here for each update.