Build Provenance
Build provenance is verifiable, tamper-evident metadata that records how a software artifact was produced, including its source inputs, build steps, and build environment, so consumers can confirm an artifact's origin and integrity.
Build provenance is a signed record, often called an attestation, that documents the origin of a software artifact. It captures details such as the source repository and commit, the build tooling and parameters, and the build environment, producing a verifiable link between a released artifact and the exact process that created it.
Provenance is typically generated automatically by the build system and cryptographically signed, frequently following an open schema such as the in-toto attestation format used within the SLSA framework. A consumer can later verify the signature and inspect the provenance to confirm the artifact came from an expected source and build pipeline before trusting or deploying it.
For developers, build provenance is a foundational defense against supply chain tampering, where an attacker tries to inject malicious code between source and release. It also supports auditing, incident response, and compliance by making the software's build history transparent and independently checkable.