Workflows · Trace software and AI

Is what was deployed what was approved?

Choose the approved manifest and the record of what was deployed, each a CycloneDX or SPDX SBOM (JSON) or a sha256sum list. Junctiq places every component in one row: the same, a different version, the same version with a different digest, approved only, or deployed only. Then it gives you a record you can keep and check later.

Your files are read in this browser and never uploaded. Two records show what they record: not what was built from which source, or what actually ran.