EpochAttest · Build Provenance

Sign every build.
Prove every claim.

Cryptographically attested SBOMs, test results, and build metadata. Hand auditors a verifiable receipt instead of a CSV export. SLSA-aligned. PQC-protected.

Start a pilot Verify a live attestation

Drop-in for CI/CD

One POST per build. Signed receipt, anchored to a public transparency log, ready to attach to your release.

Independently verifiable

Anyone with the attestation id can verify the signatures and the inclusion proof — no EpochCore account required.

Audit-grade

FIPS-aligned envelope. Anchored to your IBM Key Protect instance for the strictest compliance lanes.

Quickstart — 60 seconds

# Attest a build (subject + claims + evidence URLs)
curl -X POST https://app.epochcoreqcs.com/v1/attest \
  -H "X-API-Key: $KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "subject": "build-12345",
    "claims": {"sbom_sha256":"abc...","tests_passed":142,"go_version":"1.22.3"},
    "evidence_urls": ["https://ci.example.com/build/12345"]
  }'

# → {attestation_id, subject_hash, claims_seal, kp_wrap_attestation, cert_pdf_url, verify_url}

What ships in every receipt

Subject hash

Canonical hash over subject + claims + evidence. Tamper-evident.

Two signatures

Classical + post-quantum. Verifiable today, verifiable in 2040.

Anchored proof

Inclusion-proof URL in a public transparency log. No private timeline.

Sign every build.Prove every claim.