Sign in

v1

latestOpenAPI 3.1.02026-07-13202661.5 KB
CycloneDX Attestations (CDXAs)

Returns matching cdxas

Return the cdxas that matches the given query

get/v3/cdxas/release_name/{release_name}/{os}/{arch}/{image_type}/{jvm_impl}/{vendor}

Path parameters

arch'x64' | 'x86' | 'x32' | 'ppc64' | 'ppc64le' | 's390x' | 'aarch64' | 'arm' | 'sparcv9' | 'riscv64' required

Architecture

image_type'jdk' | 'jre' | 'testimage' | 'debugimage' | 'staticlibs' | 'sources' | 'sbom' | 'jmods' required
Example:jdk

Image Type

jvm_impl'hotspot' required

JVM Implementation

os'linux' | 'windows' | 'mac' | 'solaris' | 'aix' | 'alpine-linux' required

Operating System

release_namestring required
Example:jdk-11.0.6+10
<p> Name of the release as displayed in github or <a href="https://adoptopenjdk.net/">https://adoptopenjdk.net/</a> e.g <code>jdk-11.0.4+11, jdk8u172-b00-201807161800</code>. </p> <p> A list of release names can be obtained from <a href="https://api.adoptium.net/v3/info/release_names">https://api.adoptium.net/v3/info/release_names</a> </p>
vendor'eclipse' required
Example:eclipse
<p>Vendor of the binary. This is the organisation that produced the binary package.</p>

Query parameters

project'jdk' | 'valhalla' | 'metropolis' | 'jfr' | 'shenandoah'

Project

Project

Response

Cdxas for the given asset binary

idstring
filenamestring
featureVersioninteger
release_namestring nullable
os'linux' | 'windows' | 'mac' | 'solaris' | 'aix' | 'alpine-linux'
architecture'x64' | 'x86' | 'x32' | 'ppc64' | 'ppc64le' | 's390x' | 'aarch64' | 'arm' | 'sparcv9' | 'riscv64'
image_type'jdk' | 'jre' | 'testimage' | 'debugimage' | 'staticlibs' | 'sources' | 'sbom' | 'jmods'
jvm_impl'hotspot'
vendor'eclipse'
committedDatestring date-time
target_checksumstring nullable

Assessor checksum of attested target

assessor_orgstring nullable
assessor_affirmationstring nullable
assessor_claim_predicatestring nullable
cdxa_linkstring nullable
cdxa_sig_linkstring nullable
evidence_propertyNamestring nullable
evidence_data_namestring nullable
evidence_data_contents_attachment_textstring nullable

Example response

[
  {
    "release_name": "jdk-21.0.5+11",
    "image_type": "jdk",
    "vendor": "eclipse",
    "committedDate": "2022-03-10T16:15:50Z",
    "assessor_org": "Acme Ltd",
    "assessor_affirmation": "We claim a verified reproducible build.",
    "assessor_claim_predicate": "VERIFIED_REPRODUCIBLE_BUILD",
    "cdxa_link": "https://github.com/adoptium/temurin-cdxa/blob/main/21/jdk_21_0_6_7_x64-linux_MyOrgLtd.xml",
    "cdxa_sig_link": "https://github.com/adoptium/temurin-cdxa/blob/main/21/jdk_21_0_6_7_x64-linux_MyOrgLtd.xml.sig",
    "evidence_propertyName": "VERIFICATION_LOG",
    "evidence_data_name": "log",
    "evidence_data_contents_attachment_text": "Reproducible script output..."
  }
]