Provenance explains the source, tooling and process behind an artifact, supporting later investigation.
Evaluation approach
Link source revision, resolved dependencies, protection settings and final signatures. Protect records against unnoticed changes.
Application example
Be able to identify which approval introduced a protection rule in a problematic release.
Limits and considerations
Provenance does not make malicious or defective source safe.
Is a source revision enough?
Tools, dependencies and protection rules can change output without a source change. Bind all relevant inputs to the final artifact and prevent silent record alteration.
Checks and decisions
- Record inputs
- Protect evidence
- Bind outputs
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.