{
  "_type": "https://in-toto.io/Statement/v1",
  "subject": [
    {
      "name": "orchard-gateway-4.2.0.tgz",
      "digest": {
        "sha256": "06af88e316cf889e0b72645f235f77c900d48972456b1ff6ba4df49ae24be734"
      }
    }
  ],
  "predicateType": "https://slsa.dev/verification_summary/v1",
  "predicate": {
    "verifier": {
      "id": "https://verify.orchard.example/sample-verifier"
    },
    "timeVerified": "2026-01-01T00:00:00Z",
    "resourceUri": "pkg:npm/orchard-gateway@4.2.0",
    "policy": {
      "uri": "https://policy.orchard.example/sample/slsa-l3.yaml",
      "digest": {
        "sha256": "300c9b4e8860f45ccf2c81c4b1c09520eab361181d89f8e18c560019135bc5c1"
      }
    },
    "inputAttestations": [
      {
        "uri": "https://build.orchard.example/attestations/8814",
        "digest": {
          "sha256": "be16c79bedc4033e7d425083a67d5a8f50460757adda59ed299ac32b5aba6700"
        }
      }
    ],
    "verificationResult": "PASSED",
    "verifiedLevels": [
      "SLSA_BUILD_LEVEL_3"
    ],
    "dependencyLevels": {
      "SLSA_BUILD_LEVEL_3": 4,
      "SLSA_BUILD_LEVEL_2": 3,
      "SLSA_BUILD_LEVEL_0": 2
    },
    "slsaVersion": "1.0"
  },
  "novus_sample_note": "SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented."
}