working-with-provenance

Provenance attestations from Konflux images can be extracted using cosign and jq to decode base64 payloads and retrieve repository URLs, commit SHAs, and build logs. The skill provides helper scripts like build-log-link.sh and build-commit-link.sh that automate this extraction from an image reference.

Yes. Konflux-produced images include provenance attestations that link directly to source commits and repositories. Scripts extract the original repository URL and commit SHA from the image, enabling you to navigate from any image reference to its exact source code.

Provenance attestations contain complete build logs, pipeline information, and the original image pullspec. Extract these using cosign and jq to reproduce builds, verify build parameters, and diagnose why an SBOM or artifact is missing from a specific build.

You need cosign to retrieve and verify attestations from images and jq to parse and extract specific fields from the decoded provenance payload. Both tools are required dependencies for the skill's helper scripts.

Provenance tracing applies only to images produced by Konflux builds. Only Konflux-generated images contain the provenance attestations required to trace source commits, repositories, and build histories.

The skill includes a quick reference for common jq expressions that extract key provenance fields like repository URL, commit SHA, and build logs from the decoded attestation payload. These expressions enable custom queries beyond the provided helper scripts.