OpenChainGraph Suite · ART-136 · wave 25

SLSA Provenance Verifier

Verify an in-toto Statement SLSA provenance attestation: _type, predicateType, subject SHA-256 digest match, builder.id present, and declared SLSA build level (0–3). Zero network. Second node of the sbom-provenance-attestation chain.

SLSA v1.0in-toto StatementSupply ChainEU CRA Annex IW3C VC §13.11Zero PIIClient-side only

🔒 All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only.

Scope

Second node of the sbom-provenance-attestation chain (art-135→136→137). Validates that an in-toto SLSA provenance statement is correctly typed, that the subject digest matches the provided artifact SHA-256, and that a builder.id is declared. SLSA build level (0–3) is asserted from input — level ≥2 means two independent parties for the build process, ≥3 adds tamper-resistance for the build platform.

Presets

Inputs

in-toto Statement (JSON)

Artifact SHA-256 digest expected

Claimed SLSA build level 0–3

Result

Execution Hash & §4 Artifact

SHA-256 execution hash (JCS canonical — RFC 8785):

Chain Handoff → art-137

Pass the execution_hash above as parent_hashes[1] when calling validate_openvex_statement (art-137) to complete the sbom-provenance-attestation chain.

Ask your agent

Copy this paragraph into Claude, OpenClaw, or any MCP-aware agent to run this exact tool, with this sample, and verify the artifact.

Run the AINumbers MCP tool `verify_slsa_provenance`. Task: Verify an in-toto SLSA provenance statement: _type (in-toto.io/Statement), predicateType (slsa.dev/provenance), subject SHA-256 digest match, builder.id present, and claimed build level (0–3).
Call it with arguments: {"policy_parameters":{"statement":{"_type":"https://in-toto.io/Statement/v0.1","predicateType":"https://slsa.dev/provenance/v1","subject":[{"name":"app.tar.gz","digest":{"sha256":"abc123def456"}}],"predicate":{"runDetails":{"builder":{"id":"https://github.com/actions/runner/ubuntu-22.04@v2"}}}},"artifact_digest_sha256":"abc123def456","claimed_build_level":2}}
Verify before trusting: call `verify_execution_hash` on mcp.ainumbers.co (https://mcp.ainumbers.co/mcp) with the parameter `claimed_hash` set to the returned `execution_hash`, passing the full artifact the run returned (the object containing `policy_parameters` + `output_payload` + `execution_hash`; equivalently `policy_parameters` + `output_payload` with `claimed_hash`), not the bare hash string.
Return the ledger link https://ledger.ainumbers.co/ so a human can re-verify without contacting us.
PII rule: All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only.
Open the tool with the sample prefilled: https://ainumbers.co/chaingraph/art-136-slsa-provenance-verifier.html#p=v1.H4sIAAAAAAAA_wFTAaz-eyJzdGF0ZW1lbnQiOnsiX3R5cGUiOiJodHRwczovL2luLXRvdG8uaW8vU3RhdGVtZW50L3YwLjEiLCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9zbHNhLmRldi9wcm92ZW5hbmNlL3YxIiwic3ViamVjdCI6W3sibmFtZSI6ImFwcC50YXIuZ3oiLCJkaWdlc3QiOnsic2hhMjU2IjoiYWJjMTIzZGVmNDU2In19XSwicHJlZGljYXRlIjp7InJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY3Rpb25zL3J1bm5lci91YnVudHUtMjIuMDRAdjIifX19fSwiYXJ0aWZhY3RfZGlnZXN0X3NoYTI1NiI6ImFiYzEyM2RlZjQ1NiIsImNsYWltZWRfYnVpbGRfbGV2ZWwiOjJ9kL9kUFMBAAA