Verify provenance for Java artifacts

Retrieve the provenance for Java artifacts from a Lightwell maven repository to verify their origin and integrity.

Before you begin

You have access to the Lightwell Maven repository. For more information, see Lightwell Network repository access and Create a Lightwell Network service account.

Procedure

Save the PNC Provenance Signing Key 1 public key to a local file named pnc-provenance-signing-key-1.pub:

$ cat > pnc-provenance-signing-key-1.pub << 'EOF'
  -----BEGIN PUBLIC KEY-----
  MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYFyYXLNpOXF46lNdwKgOthCsOZ0W
  5Uc29eO5IQzw2PKVkdpb781AZ/sUh7dSpe3hjjTu2brbjtOH1FWhO2Mmrg==
  -----END PUBLIC KEY-----
  EOF

Download a Java artifact and its matching provenance bundle from the same Maven coordinate directory. The provenance bundle file name uses the following pattern:
```
<artifactId>-<version>.provenance.sigstore.json
```
where:

<artifactId>

Specifies the ID of the artifact to verify.

<version>

Specifies the version of the Maven artifact.
Verify the artifact and provenance bundle with Cosign:
Note:
The artifact and provenance bundle must be the matching pair for the same Maven coordinate and version. This verifies that the Supply-chain Levels for Software Artifacts (SLSA) provenance attestation was signed by the PNC Provenance Signing Key 1, and that its subject digest matches the downloaded artifact.
```
$ cosign verify-blob-attestation \
      --type https://slsa.dev/provenance/v1 \
      --key pnc-provenance-signing-key-1.pub \
      --bundle <artifactId>-<version>.provenance.sigstore.json \
      <artifactId>-<version>.jar
```