Skills
.Work. You
Rest

working-with-provenance

Official

Trace images back to their sources.

Software Engineering#logs#provenance#traceability#jq#SBOM#cosign#pullspec
Authorkonflux-ci
Version1.0.0
Installs0

System Documentation

What problem does it solve?

Konflux builds produce provenance attestations that tell you which source code and build logs contributed to an image. This skill helps you quickly navigate from an image reference to its origin, debug missing SBOMs, and reproduce builds by extracting provenance data with cosign and jq.

Core Features & Use Cases

  • Helper scripts to extract provenance details from images:
    • build-log-link.sh - get pipeline log URL
    • build-commit-link.sh - get commit URL
    • build-git-repo.sh - get repository URL
    • build-origin-pullspec.sh - get original image pullspec with commit
  • Quick jq expressions reference for provenance fields
  • Workflows for debugging and reproducing Konflux builds

Quick Start

Use the provided scripts to extract build logs and commits from an image reference, for example:

  • ./scripts/build-log-link.sh quay.io/org/image:tag

Dependency Matrix

Required Modules

cosignjq

Components

scripts

💻 Claude Code Installation

Recommended: Let Claude install automatically. Simply copy and paste the text below to Claude Code.

Please help me install this Skill:
Name: working-with-provenance
Download link: https://github.com/konflux-ci/skills/archive/main.zip#working-with-provenance

Please download this .zip file, extract it, and install it in the .claude/skills/ directory.
View Source Repository

Agent Skills Search Helper

Install a tiny helper to your Agent, search and equip skill from 223,000+ vetted skills library on demand.