Artifact provenance
What Is Artifact Provenance?
Artifact provenance is verifiable information about where a software artifact came from and how it was built. It works like a chain of custody, showing the source, the build process and the people or systems involved.
What Provenance Records Contain
A provenance record typically captures:
- The source repository and commit
- The build system and its configuration
- Input dependencies and their versions
- A cryptographic signature from the builder
The signature is what makes the record trustworthy.
Why Artifact Provenance Matters
A build can be tampered with after the code is reviewed. Provenance lets consumers confirm an artifact came from the expected source and pipeline. Frameworks such as SLSA use provenance as a core requirement, and it supports audits and incident response.
Provenance vs SBOM
| Term | Answers |
|---|---|
| Provenance | Where did this artifact come from and how was it built? |
| SBOM | What components are inside this artifact? |
Final Thought
Provenance replaces assumption with evidence. It lets you trust software because you can verify it.
Frequently asked questions
Is provenance the same as code signing?
No. Signing proves who published an artifact, while provenance also describes how and from what it was built.
What is SLSA?
SLSA is a security framework with levels of build integrity, and provenance is central to its requirements.
Who creates provenance?
The build system should generate it automatically, so it cannot be edited by the person who wrote the code.
Can provenance be forged?
It is hard to forge when signed by a trusted, isolated builder. Weak or self-reported provenance offers less assurance.
Does provenance apply to container images?
Yes. It applies to any artifact, including packages, binaries and container images.