{
  "_type": "https://in-toto.io/Statement/v1",
  "subject": [
    {
      "name": "orchard-gateway-4.2.0.tgz",
      "digest": {
        "sha256": "06af88e316cf889e0b72645f235f77c900d48972456b1ff6ba4df49ae24be734"
      }
    }
  ],
  "predicateType": "https://slsa.dev/provenance/v1",
  "predicate": {
    "buildDefinition": {
      "buildType": "https://build.orchard.example/buildtypes/npm/v1",
      "externalParameters": {
        "source": {
          "uri": "git+https://git.orchard.example/orchard/gateway@refs/tags/v4.2.0",
          "digest": {
            "gitCommit": "902ea810fbdd8ff73082bd2873585709f2ca500b"
          }
        },
        "config": {
          "entryPoint": ".orchard/build.yaml",
          "target": "release"
        }
      },
      "internalParameters": {
        "runnerImage": "example-linux:3.20",
        "cacheEnabled": false
      },
      "resolvedDependencies": [
        {
          "uri": "git+https://git.orchard.example/orchard/gateway@refs/tags/v4.2.0",
          "digest": {
            "gitCommit": "902ea810fbdd8ff73082bd2873585709f2ca500b"
          }
        },
        {
          "uri": "https://registry.orchard.example/@orchard-example/router/-/router-2.1.3.tgz",
          "digest": {
            "sha256": "d17f0a5171a018c41cdaaa2701b6c32bf49f7404032fa45e5721e2b794cd2e51"
          }
        },
        {
          "uri": "https://registry.orchard.example/example-logger/-/example-logger-3.4.1.tgz",
          "digest": {
            "sha256": "7fb72ea58987e5327259b66384f96f5e657c3ce5225b8891c567cac6b58430ec"
          }
        }
      ]
    },
    "runDetails": {
      "builder": {
        "id": "https://build.orchard.example/builders/hosted/v1",
        "version": {
          "orchard-builder": "1.4.0"
        }
      },
      "metadata": {
        "invocationId": "https://build.orchard.example/runs/8814",
        "startedOn": "2026-01-01T00:00:00Z",
        "finishedOn": "2026-01-01T00:06:12Z"
      },
      "byproducts": [
        {
          "name": "build.log",
          "digest": {
            "sha256": "e012cd9eeca7c53e16c89d9806845d837fea1440d973df82eb0cd17b3ad5a1d0"
          }
        }
      ]
    }
  },
  "novus_sample_note": "SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented."
}