GitHub Evidence Pack for Jira
Bundle pull requests, reviews, CI runs, and deployments into a single signed evidence ZIP per milestone — for compliance, audit, and change-management teams.
🚧 In development. Evidence Pack joins the Tamper-Evident Audit Log on the Marketplace as the second app in the Attestsys suite. Available to Audit Log Advanced and Enterprise customers when released.
The problem
When anyone — your team, a customer, an external reviewer — asks for the full story of a code change, you need: the Jira ticket, the linked pull request, the reviewers and approvals, the CI build that passed, and the deployment that shipped it.
Today that takes hours of screenshot-and-paste per milestone. Evidence Pack replaces that with a single button.
How it works
- Connect a GitHub organisation to your Jira workspace through the Attestsys admin page.
- Pick a milestone, release, or date range.
- Attestsys traverses every Jira issue in scope, follows linked GitHub references, and pulls the relevant PR / review / commit / CI / deployment metadata.
- Everything is bundled into a single ZIP, cryptographically signed with the same hash-chained pipeline as the Audit Log, and timestamped with an RFC 3161 token.
- The bundle includes the same offline
verify.htmlso the recipient (your auditor) can verify it without contacting Attestsys.
What's in the bundle
| File | Contents |
|---|---|
manifest.json | Signed manifest: scope, every PR/commit/CI/deploy with author, reviewer, timestamp |
manifest.sig | ECDSA P-256 signature over manifest.json |
cover.pdf | Human-readable summary + verification notice |
entries/<id>.payload | Canonical JSON of each captured event |
entries/<id>.signature | DER ECDSA signature per entry |
entries/<id>.tsa.der | RFC 3161 timestamp token per entry |
verify.html | Offline-verifying viewer (no network required) |
README.txt | Bundle walkthrough |
Stay in the loop
If you want to be told when Evidence Pack ships, install the Audit Log first — your workspace will get the in-product upgrade prompt the moment it's available.