Container Registry and Software Supply Chain Platform  ·  View 08 of 33  ·  2 · Structure

Evidence Plane Pipeline

What happens to a piece of evidence between arriving and being usable at an enforcement point.

Editable source SVG draw.io All views
Receive Attestation API DSSE envelope Artifact Event Consumer Harbor webhook Verify on receipt Subject in registry? Signer identity workload, not human Source allowlisted? Persist — authoritative Attestation Store MinIO object lock Append-Only Ledger PostgreSQL · hash chain Rekor Entry inclusion proof Derive — rebuildable Component Indexer purl rows Findings Projector Verdict Input Builder per digest Serve Evidence API p99 ≤ 40 ms Referrers Passthrough Replicate Evidence Topic ordered per subject Regional Replicas async · ordered Edge Caches one per cluster reject: no subject publish Evidence Plane — Receive, Verify, Persist, Derive Interface / broker Decision point Data store Security / platform Application we own Queue / topic failure / alternate event / async A correction is a new record that supersedes; no record is ever updated in place. v 1.0 · owner Platform Engineering · date 2026-09

Decisions

  • Verification happens on receipt, not at query time, so a bad attestation never enters the store
  • Records are append-only; a correction is a new record that supersedes, never an update in place
  • Verdict inputs are precomputed per digest — the inputs, never the verdict

Answering question 2

  • The verdict is computed at admission, from evidence current at that moment
  • What is precomputed and pushed to the edge is the evidence, compacted — signature validity, signer identity, finding counts by severity, suppression state
  • This keeps p99 ≤ 150 ms without creating an 'admissible yesterday, critical today' stored boolean

Risks

  • Edge cache staleness of up to 30 minutes is a real window; policy may deny on evidence age where that matters
  • Ordered replication per subject is a constraint on the Kafka partition key; getting it wrong reintroduces the window silently
◀  OCI Artifact Model All views Policy Bundle Lifecycle  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 33 views · open-source, on-premises08-evidence-plane-pipeline