Attestations
Evidence available today and the status of provenance export and signing.
Available today
On Business and Enterprise, Provenance joins recorded checks, reviews, reports and deployments into a change timeline. Retained events are checked against a stored hash chain, with integrity and retention status shown on the detail page.
Run reports can supply test results, coverage, scans, software bills of materials and build provenance. These reports are input evidence. Uploading a build provenance document does not make the change timeline a Prodgator-signed release attestation.
Coming later
Provenance attestation export and signing are coming. They are not available in the current Provenance page or API, and there is no release date to announce. Signed attestations are planned for Enterprise.
For now, review the timeline and its linked sources. Record intact checks the retained stored events; it is not a downloadable signature or an independently verifiable signed attestation.