Skip to content

Add spec page for build provenance #389

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jaimergp wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add spec page for build provenance #389

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 30 additions & 0 deletions learn/specifications/packages/provenance.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
---
sidebar_position: 60
---
# Build provenance metadata

Package builders may want to annotate build provenance of their published artifacts.

## Specification

Build provenance metadata is optional. The following metadata identifiers MAY be used to record the corresponding information:

* `sha`: String. If the recipe is under version control, it SHOULD be the full commit hash.
Otherwise, it SHOULD be an empty string.
* `remote_url`: String. If the recipe is under version control, it SHOULD be the CVS URL of the
recipe repository being built. HTTP(S) is preferred.
* `flow_run_id`: String. It SHOULD be an unambiguous identifier for the pipeline run that produced
the artifact. It tends to adopt the following syntax: `{ci-provider}_{run-id}`. Depending on the CI platform, this may be obtained through different means. For example:
* AppVeyor on Windows: `appveyor_${APPVEYOR_BUILD_ID}`.
* Azure DevOps Pipelines: `azure_$(Build.BuildNumber).$(System.JobAttempt)`. Note this is using
Azure Pipelines' macros instead of environment variables.
* Circle CI: `circle_${CIRCLE_WORKFLOW_ID}`.
* Drone CI: `drone_${DRONE_BUILD_NUMBER}`.
* GitHub Actions: `github_${GITHUB_RUN_ID}`.
* Travis CI: `travis_${TRAVIS_JOB_ID}`.

These keys are usually stored in the [`info/about.json` metadata file](./info.md), under the `extra` key.

## History

- 2026-03-04: [CEP 31](/learn/ceps/cep-0031/) is approved to standardize build provenance metadata.