Menu
Platform
AI
App store purchases
Database
Flags
Jobs and cron
Localization
Monitoring
Notifications
Payments
Queues
Sandboxes
Webhooks
Getting Started
Authentication
KV Store
Deploy & Infrastructure
Reference
Provenance
Reading the SBOM and the signed provenance a build ended with.
Today this runs on the management API
The served build record is GET /v1/deployments/builds/{id}, which returns the build's image digest under image.digest. The builds get call below, with the SBOM and signed-provenance digests, belongs to the builds collection, which api.sylphx.com does not serve. See the Builds quickstart.
A build that succeeds does not only produce an image. It ends with three digests — the image, its SBOM and its signed provenance — and with the name of one Artifact holding all three. Nothing extra is called to get them: they are part of the build's own record.
#Read the build's output
The output is on the build, so the read is the ordinary one:
sylphx build builds get orgs/acme/projects/shop/builds/buildcurl "https://api.sylphx.com/v1/orgs/acme/projects/shop/builds/build" \
-H "Authorization: Bearer $SYLPHX_API_KEY"const response = await sylphx.build.builds.get({ name: 'orgs/acme/projects/shop/builds/build' })status.output is set when status.state is succeeded, and it carries
these five fields:
| Field | Type | What it is |
|---|---|---|
image | string | The image reference: registry.sylphx.net/path@sha256:hex. |
image_digest | string | The image manifest digest. |
sbom_digest | string | The SBOM Artifact digest. |
provenance_digest | string | The signed SLSA provenance Artifact digest. |
artifact | string | The Kernel Artifact holding the three. |
image is the reference to pull, and it is already by digest rather than by
tag: registry.sylphx.net/<path>@sha256:<hex>. The two Artifact digests are
the parts that make the image checkable rather than merely pullable — the SBOM
says what is inside it, and the signed provenance says what produced it.
#One Artifact, three digests
The three digests are named together by output.artifact, so a reader does
not have to correlate three records to answer one question. The Artifact is
where they live, and the artifacts collection is what
reads it.
That is also why a build is worth reading after the fact. A build is immutable once created, so the digest it ended with is the digest of the image it made — a later build of the same repository produces its own record rather than editing this one.
#When there is nothing to read
status.output is only present on a build that succeeded. A build that failed
carries status.failure instead, which is a typed reason — the source was
unavailable, the build itself errored, there was no capacity, the class was
not offered, signing was unavailable, or the build timed out.
A cancelled build publishes nothing at all. Its lease is released and no Artifact is written, so there is no SBOM and no provenance to read for it. That is the difference between a build that failed and a build that was stopped: one has a reason, the other has no result.