Attestable Builds

Attestable builds are a new approach to verifiable software distribution. Source code is compiled inside hardware-isolated environments that produce cryptographic proof linking binaries to their exact inputs.

POST /build

Build with attestation from a ZIP upload or git repository. Supports both Cargo and Nix projects via auto-detection.

Request

All requests use multipart/form-data. You must provide either a source file OR a repo_url, not both.

Option 1: Git Repository

curl -X POST https://api.kettle.build/v1/build \
  -F "repo_url=https://github.com/owner/repo" \
  -F "ref=main"

Option 2: ZIP Upload

curl -X POST https://api.kettle.build/v1/build \
  -F "source=@source.zip"

Parameters

ParameterTypeRequiredDescription
sourcefileNo*ZIP file containing source code
repo_urlstringNo*Git repository URL to clone
refstringNoGit ref (branch, tag, or commit). Only used with repo_url

*One of source or repo_url must be provided, but not both.

Response

Success (200)

{
  "build_id": "a1b2c3d4",
  "status": "success",
  "artifacts": [
    {
      "name": "my-binary",
      "sha256": "abc123...",
      "download_url": "/builds/a1b2c3d4/artifacts/my-binary"
    }
  ],
  "build_config": {
    "name": "Cargo.lock",
    "download_url": "/builds/a1b2c3d4/build-config/Cargo.lock"
  },
  "provenance": { ... },
  "attestation": "base64-encoded-attestation..."
}

Failure (400 or 500)

{
  "build_id": "a1b2c3d4",
  "status": "failed",
  "error": "Description of what went wrong",
  "error_type": "UnsupportedToolchainError"
}

Error Codes

StatusError TypeDescription
400UnsupportedToolchainErrorProject uses an unsupported build toolchain
400-Invalid input (both source and repo_url provided, or neither)
400-Git clone failed (invalid URL or ref)
500-Internal build failure