v1

latestOpenAPI 3.1.02026-07-13202661.5 KB

CycloneDX Attestations (CDXAs)

Returns cdxas that target the given SHA256 checksum

Return the list of cdxas that have the matching target binary SHA256 checksum

get/v3/cdxas/target_checksum/{target_checksum}

Path parameters

target_checksumstring required

Example:6773cfdc56d66b75f4a88ac843b2b5854791240114cf8bb1b56fb6f7826ae436

Target binary SHA256 checksum

Query parameters

project'jdk' | 'valhalla' | 'metropolis' | 'jfr' | 'shenandoah'

Project

Response

Cdxas for the given target binary SHA256 checksum

idstring

filenamestring

featureVersioninteger

release_namestring nullable

architecture'x64' | 'x86' | 'x32' | 'ppc64' | 'ppc64le' | 's390x' | 'aarch64' | 'arm' | 'sparcv9' | 'riscv64'

jvm_impl'hotspot'

vendor'eclipse'

committedDatestring date-time

target_checksumstring nullable

Assessor checksum of attested target

assessor_orgstring nullable

assessor_affirmationstring nullable

assessor_claim_predicatestring nullable

cdxa_linkstring nullable

cdxa_sig_linkstring nullable

evidence_propertyNamestring nullable

evidence_data_namestring nullable

evidence_data_contents_attachment_textstring nullable

Example response

[
  {
    "release_name": "jdk-21.0.5+11",
    "image_type": "jdk",
    "vendor": "eclipse",
    "committedDate": "2022-03-10T16:15:50Z",
    "assessor_org": "Acme Ltd",
    "assessor_affirmation": "We claim a verified reproducible build.",
    "assessor_claim_predicate": "VERIFIED_REPRODUCIBLE_BUILD",
    "cdxa_link": "https://github.com/adoptium/temurin-cdxa/blob/main/21/jdk_21_0_6_7_x64-linux_MyOrgLtd.xml",
    "cdxa_sig_link": "https://github.com/adoptium/temurin-cdxa/blob/main/21/jdk_21_0_6_7_x64-linux_MyOrgLtd.xml.sig",
    "evidence_propertyName": "VERIFICATION_LOG",
    "evidence_data_name": "log",
    "evidence_data_contents_attachment_text": "Reproducible script output..."
  }
]