working-with-provenance

Name: working-with-provenance
Availability: InStock
Author: konflux-ci

Trace Konflux image provenance to source commits and build logs.

8|12|Updated Nov 7, 2025

Search Tags:#logs #provenance #traceability #jq #SBOM #cosign #pullspec

Ready to run

npx skills add https://github.com/konflux-ci/skills --skill working-with-provenance

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: working-with-provenance
Source: https://github.com/konflux-ci/skills/tree/main/skills/working-with-provenance
Command: npx skills add https://github.com/konflux-ci/skills --skill working-with-provenance

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires cosign, jq, and includes scripts (resource) components.

What problem does it solve?

Konflux builds produce provenance attestations that tell you which source code and build logs contributed to an image. This skill helps you quickly navigate from an image reference to its origin, debug missing SBOMs, and reproduce builds by extracting provenance data with cosign and jq.

Core Features & Use Cases

Helper scripts to extract provenance details from images:
- build-log-link.sh - get pipeline log URL
- build-commit-link.sh - get commit URL
- build-git-repo.sh - get repository URL
- build-origin-pullspec.sh - get original image pullspec with commit
Quick jq expressions reference for provenance fields
Workflows for debugging and reproducing Konflux builds

Quick Start

Use the provided scripts to extract build logs and commits from an image reference, for example:

./scripts/build-log-link.sh quay.io/org/image:tag

Frequently Asked Questions about working-with-provenance

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I extract provenance information from a Konflux container image?▼

Provenance attestations from Konflux images can be extracted using cosign and jq to decode base64 payloads and retrieve repository URLs, commit SHAs, and build logs. The skill provides helper scripts like build-log-link.sh and build-commit-link.sh that automate this extraction from an image reference.

Can I trace a container image back to its source commit and repository?▼

Yes. Konflux-produced images include provenance attestations that link directly to source commits and repositories. Scripts extract the original repository URL and commit SHA from the image, enabling you to navigate from any image reference to its exact source code.

How do I debug a Konflux build using provenance data?▼

Provenance attestations contain complete build logs, pipeline information, and the original image pullspec. Extract these using cosign and jq to reproduce builds, verify build parameters, and diagnose why an SBOM or artifact is missing from a specific build.

What tools do I need to work with Konflux provenance attestations?▼

You need cosign to retrieve and verify attestations from images and jq to parse and extract specific fields from the decoded provenance payload. Both tools are required dependencies for the skill's helper scripts.

Does provenance tracing work with any container image or only Konflux builds?▼

Provenance tracing applies only to images produced by Konflux builds. Only Konflux-generated images contain the provenance attestations required to trace source commits, repositories, and build histories.

How do I use jq expressions to extract specific provenance fields?▼

The skill includes a quick reference for common jq expressions that extract key provenance fields like repository URL, commit SHA, and build logs from the decoded attestation payload. These expressions enable custom queries beyond the provided helper scripts.