Skip to main content

​
The Problem

Software supply chain attacks are among the most impactful security incidents of the last decade. The attack surface is the gap between where code is built and where it runs - a gap that traverses artifact registries, package managers, deployment pipelines, and update mechanisms. The core vulnerability is that software artifacts are files. Files can be altered. Most organisations have no mechanism to prove that the artifact running in production is bit-for-bit identical to the artifact that passed security review, was signed by a trusted build system, and was approved for release. When an incident occurs - a compromised dependency, a tampered container image, a backdoored update - the investigation starts with a question that is often unanswerable: was this artifact modified after it left the build system? ROOTKey makes that question answerable.

​
How ROOTKey Solves It

ROOTKey anchors a cryptographic hash of each artifact to the Polygon blockchain at the point of creation - the moment the build system produces it. This anchor is:
  • Build-time timestamped - the block timestamp is set by blockchain consensus, not by your CI system
  • Immutable - no registry, no deployment system, no attacker with pipeline access can alter the anchor
  • Independently verifiable - any deployment system, customer, or auditor can verify an artifact’s integrity before executing it, without contacting the build system
If an artifact is tampered with after anchoring - in the registry, in transit, or in the update mechanism - the hash will not match the on-chain record. The tampering is detectable before deployment.

​
Architecture

Anchoring is a single API call inserted into the CI pipeline after the build step.

​
Implementation

1

Create a vault per artifact type or repository

Create one vault per artifact category - container images, release binaries, configuration packages, SBOM files. This organises your artifact history and allows access-controlled verification by external parties.→ Create Vault
2

Insert an anchor step into your CI pipeline

After the build produces an artifact, call the ROOTKey API to anchor it. This is a single API call that can be added to any CI system - GitHub Actions, GitLab CI, Jenkins, CircleCI, or any pipeline tool that can make HTTP requests.→ Create File · API Integration Guide
3

Verify before deployment

At the start of each deployment job, validate the artifact against its on-chain anchor. If the validation returns invalid, fail the deployment - do not proceed.→ Validate File
4

Anchor SBOM and signing metadata

Anchor your Software Bill of Materials, code signing certificate references, and dependency manifests alongside the artifact. This creates a complete, tamper-evident provenance record for every release.→ Create File Version
5

Provide verifiable release provenance to customers

Share the vault ID and file ID with customers or security teams. They can independently verify that the artifact they downloaded matches the one produced by your build system - without trusting your registry or your assurance.→ Get File · Get File Versions

​
Key API Endpoints

​
Compliance Alignment

Get started - free account

Add artifact anchoring to a sandbox pipeline in minutes. No infrastructure changes required.

Talk to our DevSecOps team

We’ll design a pipeline integration and verification gate architecture tailored to your CI/CD toolchain and threat model.