Evidence Deployment Workflow

JFrog Artifactory Documentation
Products
JFrog Artifactory
Content Type
User Guide
ft:sourceType
Paligo

When external evidence is deployed to Artifactory, the evidence file is parsed and validated according to the following sequence:

  1. Validates the token used to authenticate the user invoking the Deploy Evidence APIDeploy Evidence

  2. Parses and validates the DSSE evidence envelope

  3. Decodes the Base64 payload inside the DSSE envelope

  4. Verifies the signature

  5. Parses and validates the evidence payload

  6. Validates the repository type of the evidence subject (must be local or Federated)

  7. Validates the existence of the evidence subject in the specified path in Artifactory

  8. Resolves the subject from Artifactory using its full repository path

  9. Verifies the subject's digest (if the sha256 is provided in the request)