---
tags: scitt
---
###### tags: `scitt`

# SCITT: Persistance

For the following scenarios, where is each artifact and/or statement persisted?
The following table is a work in progress, to faciliate discussion.
A target/goal would be end users download artifacts, claims/statements and supporting evidence from the same location. This isn't just a browser skin across multiple services, rather the integration of the services so users configure one set of network endpoints to get artifacts, claims/statements and evidence from the same endpoint.

While we can overlay SCITT APIs on existing services, not all storage services support all content types.

| artifact | artifact storage | evidence type | scitt ledger type | statement storage |
| - | - | - | - | - |
| **container image** | OCI Registry | SBOM | scitt-reference | OCI registry |
| container image | OCI Registry | in-toto attestation | in-toto | scitt |
| container image | OCI Registry | scan result | scitt-reference | OCI registry |
| container image | OCI Registry | provenance | scitt-reference | OCI registry |
| **nuget package** | nuget.org | SBOM | scitt-reference | nuget.org? |
| nuget package | nuget.org | in-toto attestation | scitt | nuget.org |
| nuget package | nuget.org | scan result | scitt-reference | nuget.org |
| nuget package | nuget.org | provenance | scitt-reference | nuget.org |
| **windows vhd** | image gallery | SBOM | scitt-reference | OCI registry |
| windows vhd | image gallery | in-toto attestation | in-toto | scitt |
| windows vhd | image gallery | scan result | scitt-reference | OCI registry |
| windows vhd | image gallery | provenance | scitt-reference | OCI registry |
| **windows driver** | download center | SBOM | scitt-reference | MAR |
| windows driver | download center | in-toto attestation | in-toto | scitt |
| windows driver | download center | scan result | scitt-reference | MAR |
| windows driver | download center | provenance | scitt-reference | MAR |
| **bicep module** | MAR / OCI Registry | SBOM | scitt-reference | MAR / OCI Registry |
| bicep module | MAR / OCI Registry | in-toto attestation | in-toto | scitt |
| bicep module | MAR / OCI Registry | scan result | scitt-reference | MAR / OCI Registry |
| bicep module | MAR / OCI Registry | provenance | scitt-reference | MAR / OCI Registry |
| **Azure Service** | MAR | SBOM | scitt-reference | MAR |
| Azure Service | MAR | in-toto attestation | in-toto | scitt |
| Azure Service | MAR | scan result | scitt-reference | MAR |
| Azure Service | MAR | provenance | scitt-reference | MAR |