ConClear simple builder v1

This page defines the build environment identified in SLSA Provenance by:

https://foundata.com/en/projects/conclear/builder/simple-v1/

Scope

The simple v1 builder is a foundata operator-controlled Linux workstation used to run ConClear’s complete qualification and release workflow. Its trust boundary includes the authorized operator, workstation administration, operating system and hardware, the selected ConClear build, and the external tools ConClear invokes.

This identity describes a trust domain, not one ConClear release or source revision. Provenance records the exact ConClear version and source revision separately in runDetails.builder.version.

SLSA level

This builder claims SLSA Build L1 only. ConClear creates provenance describing the build, but no independent hosted control plane prevents the operator or build process from altering that provenance. The builder does not claim Build L2 or Build L3.

Running ConClear inside an arbitrary CI worker does not make that worker part of this trust domain and does not raise the claimed SLSA level. A CI environment with a different trust boundary needs its own builder identity and documentation.

Provenance guarantees

ConClear obtains the canonical source repository and full revision from an isolated Git checkout. It validates repository configuration from that revision, records the OCI subject and platform digests, binds evidence by digest, records the exact ConClear and external-tool versions, and verifies the resulting signatures and attestations before promotion.

The provenance subject is derived from the assembled OCI graph and checked against the graph published to the registry. buildDefinition.externalParameters records the selected image, optional release version, ConClear run identifier and configured platforms. buildDefinition.internalParameters is empty. resolvedDependencies records the isolated source commit, repository configuration, Containerfile and external image materials known to ConClear. Dependency completeness is best effort and does not claim to discover every resource fetched by arbitrary build steps.

runDetails.builder.version records the exact ConClear version and source revision. The invocation identifier is ConClear’s lowercase ULID for the release run. Start and finish times come from the workstation clock. ConClear emits no provenance extension fields for this builder; consumers interpret unknown extension fields according to the SLSA Provenance v1 parsing rules.

Tenant-controlled fields

The authorized operator selects the source revision, image, optional release version and protected release profile. The source repository controls the Containerfile, conclear.toml, build context and declared test hooks. These values are validated and bound by digest where applicable, but no independent trusted control plane authenticates the operator’s selections or guarantees that every possible build influence was recorded. Optional CI context is correlation metadata only and does not alter the builder identity or provenance verdict.

ConClear uses detached source worktrees, run-owned state and rootless container tools. Trust and credential files remain outside the project repository and are accepted only from protected release-profile paths. These controls reduce accidental contamination but do not provide the hardened isolation required by higher SLSA Build levels.

Signing and verification

Consumers must accept this builder only together with an explicitly approved signing identity. ConClear verifies the configured builder.id, provenance subjects, evidence digests and signing identity before promotion. A signature from an unapproved signer does not authorize this builder, and an approved signer does not authorize another builder identity automatically.

Version policy

The meaning and trust boundary of simple v1 do not change retroactively. Clarifications that preserve those semantics may update this page. A security-significant change to the environment, guarantees or claimed level requires a new builder URI, such as simple-v2.