Signed provenance

A passing scan is worth less if the artifact can be swapped on the way out. Builds carry signed provenance, so you can prove an artifact came from the pipeline you expect and was not swapped along the way. Key points:

• Signed provenance is the attestation that ties an artifact back to the build that produced it.
• Speak of signed provenance and attestation. This is about proving build origin, not a standards-conformant software bill of materials.