Proven
PQC-signed supply-chain attestor. Reproducible builds with byte-identity hashing keyed on (host, rustc-version, Cargo.lock). Verification designed to survive the post-2030 quantum transition.
01
What it does
ML-DSA-65 Attestation
Cryptographically signs published binaries with post-quantum digital signatures resilient against harvest-now-decrypt-later attacks.
Merkle AST Verification
Binds the build output directly to source commit, AST Merkle root, and dependency fingerprints.
Capability Token Matrix
Embeds execution boundaries, sandbox constraints, and runtime capability grants directly into the attestation envelope.
Air-Gappable & SLSA L3+
Validates bit-reproducibility without requiring live network calls to centralized certificate transparency logs.
02
Installation
# Install Proven via the studio2201 installer:
curl -fsSL https://studio2201.com/install.sh | sh -s proven03
Terminal usage
# Attest a compiled binary with ML-DSA-65
proven attest --target target/release/app --key identity.pqc
# Verify provenance against baseline Merkle root
proven verify --target target/release/app --attestation app.slsa.pqc
# Emit SLSA L3+ compatible statement
proven emit-slsa --output provenance.json04
Compliance & Post-2030 Mandates
Executive Order 14412
Fulfills federal High Value Asset (HVA) post-quantum cryptography directives ahead of the federal deadline.
Classical Signature Obsolescence
Traditional RSA/ECDSA signing models are quantum-vulnerable by 2030. Proven is post-quantum native from day one.
Zero Dependencies
Zero third-party crates. Self-contained cryptographic implementations honoring the strict studio2201 zero-trust doctrine.
Reproducible Baselines
Employs host- and rustc-keyed baselines ensuring byte-identical verification across distributed pipelines.