GET /build/{id}/result

Downloads the build outputs as a gzipped tarball (Content-Type: application/gzip). Available only after the build reaches a successful complete event — see GET /build/{id}/events for tracking build progress.

Parameters

Returns 404 Not Found if the job is unknown or the result is not yet available.

Example

curl https://build.confidential.ai/build/$JOB/result -o build.tar.gz
tar -xzf build.tar.gz

Archive contents

The tarball unpacks into a single top-level directory named after the built project:

<project>/
├── artifacts/            # compiled build outputs
│   └── ...
├── provenance.json       # SLSA build provenance
└── evidence.json         # attestation evidence (when attestation is enabled)

Pass the same nonce you submitted to kettle verify to confirm the attestation was produced for your request:

kettle verify ./<project> --nonce 0a1b2c3d4e5f60718293a4b5c6d7e8f9

You can also verify the entire build chain including the build VM's firmware, kernel, OS, and build tools. Fetch the exact image used to boot your VM, and use Kettle to check that your attestation matches the IGVM file (containing firmware, kernel, initfs, and full disk dm-verity root hash), plus verify that the disk image exactly matches the dm-verity root hash contained in the IGVM.

You'll need to use commands specific to your build, which are printed once the build is complete. The commands to fetch the image and verify everything will look like this:

oras pull ghcr.io/confidential-dot-ai/kettle-build@<sha256>
kettle verify ./<project> --nonce <nonce> --igvm guest-smp10.igvm --image disk.raw