For the complete documentation index, see llms.txt. This page is also available as Markdown.
Attestations
PDF and VEX attestations per sealed package, plus how to download them from the Sealed packages tab.
For every sealed package version, Seal publishes two attestation artifacts:
A PDF attestation, human-readable, suitable for handing to a compliance reviewer or auditor.
A Vulnerability Exploitability eXchange (VEX) record, machine-readable, suitable for attaching to an SBOM and for scanners that consume VEX statements.
Both cover the same underlying facts in different forms. Use the PDF for review by people; use the VEX record for review by tooling.
What each contains
PDF attestation
A human-readable document that lists, per sealed package version:
The artifact identity (ecosystem, package name, sealed version).
The vulnerabilities the sealed iteration closes, with their identifiers and severity.
The artifact's SHA-256 hash.
The PDF is signed by Seal so its provenance can be verified.
VEX record
A machine-readable statement following standard VEX schemas. Suitable for attaching to an SBOM or for scanners that consume VEX statements directly. Carries the package identity and, per vulnerability, a status (fixed or affected) with the vulnerability identifier.
Find the row for the sealed package version. Use the filters at the top of the tab to narrow if needed.
Click the row's action menu.
Choose Download attestation for the PDF, or Download VEX attestation for the VEX record.
The file is generated on demand and delivered through a toast notification when ready.
Per-package attestation downloads in the row's action menu.
Downloading through the Seal AI Agent
You can also ask the Seal AI Agent for a sealed package version's attestation in chat. The Agent surfaces a Download attestation or Download VEX attestation button in the thread, backed by the same artifacts as the Sealed packages tab.
Bulk-downloading attestations
For audits and similar bulk-evidence cases, the Sealed packages tab carries top-level Download all attestations and Download all VEX attestations actions. Each bundles one attestation per row currently visible under the tab's filters.
Apply the filters first to narrow the set of rows to the scope you want in the bundle (by Seal Project, severity, package name, and so on); then click the top-level actions menu and pick the bulk download. What you see in the tab is what you get in the bundle.
