Attested Builds

Attested builds are a new approach to verifiable software distribution. Source code is compiled inside hardware-isolated environments that produce cryptographic proof linking binaries to their exact inputs.

GET /build/{id}/result

Downloads the build outputs as a gzipped tarball (Content-Type: application/gzip). Available only after the build reaches a successful complete event — see GET /build/{id}/events for tracking build progress.

Parameters

ParameterInDescription
idpathThe job_id returned by POST /build.

Returns 404 Not Found if the job is unknown or the result is not yet available.

Example

curl https://build.confidential.ai/build/$JOB/result -o build.tar.gz
tar -xzf build.tar.gz

Archive contents

The tarball unpacks into a single top-level directory named after the built project:

<project>/
├── artifacts/            # compiled build outputs
│   └── ...
├── provenance.json       # SLSA build provenance
└── evidence.json         # attestation evidence (when attestation is enabled)

Pass the same nonce you submitted to kettle verify to confirm the attestation was produced for your request:

kettle verify ./<project> --nonce 0a1b2c3d4e5f60718293a4b5c6d7e8f9