Build provenance.

Verifiable records of how and from what each artefact was built.

Standards

  • SLSA (OpenSSF)
  • in-toto

OTA updates, GitOps and software supply chain