License trust and badges

Which path applies to me?

Four simple steps to review

1. 1

   Choose the file

   Billixi immediately checks its extension and type and warns when it may be executable.

2. 2

   Save the private draft

   The file enters quarantine and is not available to buyers or the store.

3. 3

   Complete two checks

   File Safety scans these exact bytes. Verified Build links them to a specific repository, commit, and GitHub Actions run.

4. 4

   Submit once

   After both checks turn green, Submit is enabled and Ops performs the final review.

What do the two checks mean?

Connect GitHub

Billixi asks for read-only Metadata and Contents access, scoped to repositories you select. Attestations access is optional and used only for GitHub-native provenance. Billixi never commits, opens a PR, clones the repository, or stores an installation token.

Place the one-time challenge file

Copy the path and the product-specific JSON shown in Trust & Verification. Commit it to the selected repository. Billixi resolves one commit first and reads the file only from that exact commit. The displayed challenge normally expires after 24 hours.

.billixi/product-claim.json

{
  "schema": "billixi-product-claim/v1",
  "product_id": "<your-product-id>",
  "challenge": "<one-time-value>",
  "expires_at": "<shown-expiry>"
}

GitHub web: Add file → Create new file → enter the exact path → paste JSON → commit. Git local: create the directories and file, commit, push, then enter that branch or commit in Billixi and choose Check again.

Common fixes: exact path and case, correct branch, unexpired challenge, unchanged JSON, and restored app permission.

Generate private build provenance

GitHub Actions signs a short-lived OIDC proof that binds the private repository, workflow, commit, GitHub-hosted runner, Billixi product, and final file SHA-256. Billixi stores only immutable claims and token digests—not the token or source. No Enterprise plan, public repository, secret, or personal token is required.

name: Private release provenance
on:
  push:
    tags: ['v*']

permissions:
  contents: read
  id-token: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Build artifact
        run: ./scripts/build-release.sh
      - name: Prove the exact private build to Billixi
        shell: bash
        env:
          BILLIXI_PRODUCT_ID: '<your-product-id>'
          BILLIXI_ARTIFACT_PATH: dist/my-product.zip
          BILLIXI_PROOF_ENDPOINT: https://api.billixi.com/api/v1/payment/source-providers/github/actions/build-proofs
        run: |
          set -euo pipefail
          sha256="$(sha256sum "$BILLIXI_ARTIFACT_PATH" | cut -d ' ' -f1)"
          compact_product_id="$(tr -d '-' <<<"$BILLIXI_PRODUCT_ID")"
          audience="billixi-source-trust:${compact_product_id}:${sha256}"
          encoded="$(jq -rn --arg value "$audience" '$value | @uri')"
          response="$(curl --silent --show-error --fail-with-body \
            -H "Authorization: Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \
            "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=${encoded}")"
          token="$(jq -er '.value' <<<"$response")"
          echo "::add-mask::$token"
          body="$(jq -cn --arg productId "$BILLIXI_PRODUCT_ID" --arg artifactSha256 "$sha256" \
            --arg artifactName "$(basename "$BILLIXI_ARTIFACT_PATH")" \
            '{productId:$productId,artifactSha256:$artifactSha256,artifactName:$artifactName}')"
          curl --silent --show-error --fail-with-body \
            -H "Authorization: Bearer ${token}" -H 'Content-Type: application/json' \
            --data "$body" "$BILLIXI_PROOF_ENDPOINT" >/dev/null
          unset token response

sha256sum dist/my-product.zip
# macOS
shasum -a 256 dist/my-product.zip

Get-FileHash .\dist\my-product.zip -Algorithm SHA256

Statuses and fixes

Waiting for GitHub

Install the app or retry after a temporary provider outage.

Repository verified

The exact claim commit passed and remains within its freshness window.

Attestation missing

Run the release workflow for the final asset, then retry verification.

Digest mismatch

The attested or provider digest is not the Billixi SHA-256. Create a new release with unchanged final bytes.

Wrong workflow identity

Use the workflow allowed by the product policy; Ops cannot bypass it.

Waiting for Billixi scan

The imported bytes are quarantined and waiting for the independent scan.

Scan rejected

Fix the artifact and create a new release; provenance cannot bypass the scan.

Manual review

Billixi found evidence that needs security or ownership review.

Approved

The exact release passed the applicable gate.

Connection revoked

Reinstall or re-authorize the GitHub App and verify the repository again.

Attestation stale or revoked

Create valid new evidence or retry after trusted-root recovery.