{
  "type": "excalidraw",
  "version": 2,
  "source": "https://excalidraw.com",
  "elements": [
    {
      "type": "text",
      "version": 1,
      "versionNonce": 1,
      "isDeleted": false,
      "id": "placeholder-title",
      "fillStyle": "solid",
      "strokeWidth": 1,
      "strokeStyle": "solid",
      "roughness": 1,
      "opacity": 100,
      "angle": 0,
      "x": 100,
      "y": 80,
      "width": 600,
      "height": 30,
      "seed": 1,
      "groupIds": [],
      "frameId": null,
      "roundness": null,
      "boundElements": [],
      "updated": 1,
      "link": null,
      "locked": false,
      "fontSize": 28,
      "fontFamily": 1,
      "text": "Figure 5.1 \u2014 Attached artifacts",
      "textAlign": "left",
      "verticalAlign": "top",
      "containerId": null,
      "originalText": "Figure 5.1 \u2014 Attached artifacts",
      "lineHeight": 1.25,
      "baseline": 22
    },
    {
      "type": "text",
      "version": 1,
      "versionNonce": 2,
      "isDeleted": false,
      "id": "placeholder-hint",
      "fillStyle": "solid",
      "strokeWidth": 1,
      "strokeStyle": "solid",
      "roughness": 1,
      "opacity": 100,
      "angle": 0,
      "x": 100,
      "y": 140,
      "width": 600,
      "height": 200,
      "seed": 2,
      "groupIds": [],
      "frameId": null,
      "roundness": null,
      "boundElements": [],
      "updated": 1,
      "link": null,
      "locked": false,
      "fontSize": 16,
      "fontFamily": 1,
      "text": "One central box at the top: \"OCI image manifest\" (red-accent).\n\nThree boxes below, fanning out:\n  - Cosign signature (left): tamper detection\n  - SBOM attestation (middle): SPDX or CycloneDX, signed\n  - Provenance attestation (right): SLSA build origin, signed\n\nLines from the manifest down to each artifact.\nCaption: stored alongside the manifest, verifiable with cosign.\n",
      "textAlign": "left",
      "verticalAlign": "top",
      "containerId": null,
      "originalText": "One central box at the top: \"OCI image manifest\" (red-accent).\n\nThree boxes below, fanning out:\n  - Cosign signature (left): tamper detection\n  - SBOM attestation (middle): SPDX or CycloneDX, signed\n  - Provenance attestation (right): SLSA build origin, signed\n\nLines from the manifest down to each artifact.\nCaption: stored alongside the manifest, verifiable with cosign.\n",
      "lineHeight": 1.3,
      "baseline": 14
    }
  ],
  "appState": {
    "gridSize": null,
    "viewBackgroundColor": "#ffffff"
  },
  "files": {}
}