Modern software supply chains rely on trust.
You trust the CI system. You trust the maintainer. You trust the registry. You trust the binary.
In most cases, this trust is not verifiable.
An artifact may claim to be built from a source, but the claim itself is rarely provable. Logs can be modified. Build systems can be compromised. Maintainers can make mistakes. Signatures alone do not prove how something was built.
Most systems provide statements. Few provide proof.
ISCProof moves trust away from people and infrastructure, and attaches it to verifiable records.
ISCProof defines a protocol for generating portable, verifiable build attestations.
The specification defines:
ISCProof does not define a CI system.
ISCProof does not define a package registry.
ISCProof does not define a hosting service.
ISCProof defines a verification layer.
ISCProof defines the following roles.
Produces the artifact.
Creates a signed statement about the build.
Checks that the artifact matches the statement.
Carries artifact and proof.
The key or identity used for signature verification.
The protocol assumes that signatures are valid only if the verifier trusts the corresponding root key.
Trust must be attached to proof, not to infrastructure.
Verification must not depend on the builder.
An artifact is trusted because its proof can be verified.
A binary output produced by a build. Artifacts are identified by hash.
A signed record describing the build. Contains: artifact hash, source reference, builder identity, timestamp, build inputs, signature.
The canonical ISCProof record. Binds artifact → attestation → signature. Must be portable and verifiable without external state.
Requires: artifact, seal, public key. Must confirm hash matches, signature valid, attestation format valid, rules satisfied. Must not require CI or registry access.
ISCProof does not attempt to:
ISCProof only ensures that claims about a build can be verified.
The ISCProof specification is implemented by BuildSeal.
BuildSeal provides: CLI builder, seal generator, public verifier, signature validation.
BuildSeal is a reference implementation, not part of the specification. Other implementations are expected.
Today, trust lives in CI systems, maintainers, registries, and logs.
ISCProof moves trust to hashes, signatures, attestations, and verifiable records.
Trust should be transferable.
Trust should be verifiable.
Trust should not depend on authority alone.
ISCProof exists to make that possible.