DevSecOps Practice Hub

Build Provenance

Record verifiable metadata describing how, where and from what source an artefact was built.

AdvancedProvenanceSupply Chain

Where it fits in the lifecycle

  1. Plan
  2. Code
  3. Build
  4. Test
  5. Release
  6. Deploy
  7. Operate
  8. Monitor
  • Build Dependency scanning, image scanning, SBOM generation and signing.
  • Release Approval controls, artefact promotion and provenance.

Overview

Provenance is a signed statement about the build: source repository and commit, builder identity, parameters and dependencies. It answers 'where did this binary actually come from'.

Why it matters

Provenance turns build integrity from a policy claim into a verifiable fact, and is a prerequisite for higher SLSA levels.

How it works

  1. 01The build platform emits an in-toto statement describing the build.
  2. 02The statement is signed with the builder identity.
  3. 03Verification policy checks the source repo, ref and builder before deployment.

Common tools

in-totoSigstore CosignSLSA GitHub GeneratorGitHubGitLabSLSA

Implementation examples

bashVerify provenance attestation
cosign verify-attestation --type slsaprovenance \  --certificate-oidc-issuer https://token.actions.githubusercontent.com \  --certificate-identity-regexp '^https://github.com/acme/' \  $IMAGE_DIGEST

Best practices

  • Generate provenance on the build platform, not in a user-controlled step.
  • Fail deployment when provenance is missing rather than warning.

Common mistakes

  • Producing provenance in the same script an attacker could modify.

Hands-on labs