Software supply chain in depth

Correct — Compromise one build and every consumer gets the payload — the leverage attackers seek.

Correct — The malicious code was inserted during build, so it inherited legitimate signing and distribution.

Correct — It answers "was this artifact built the way we claim, from the source we claim?".

Correct — The entry rung: you can produce and consume provenance, even if not yet hardened.

Correct — L3 makes it infeasible for a build to forge its own provenance.

Correct — No fetching arbitrary things mid-build; the inputs are pinned and known.

Correct — Provenance is the verifiable "birth certificate" of the artifact.

Correct — A compromised build can sign a backdoored artifact — provenance is needed to trust the build itself.

Correct — v1.0 formalized the Build track; other tracks are in progress.

Correct — Misconfigured resolution can pull the attacker’s public package over your private one.

Correct — A divergent rebuild reveals injected changes.

Correct — End-to-end, tamper-evident assurance from commit to running workload.

Correct — It records and verifies what happened at each stage of the pipeline.

Correct — The statement says "about THIS artifact, here is this claim".

Correct — Digest binding ensures the claim applies to exactly that artifact, not a lookalike.

Correct — SLSA provenance is a standardized in-toto predicate type.

Correct — An unsigned attestation could be forged or altered by anyone.

Correct — It summarizes a verification decision for reuse.

Correct — The OCI referrers API links attestations to the image they describe.

Correct — A compromised build could otherwise fabricate a clean-looking provenance.

Correct — Subject = what; predicate = the claim about it.

Correct — e.g. "built by our pipeline AND scanned AND signed" at admission.

Correct — Complementary claims — build integrity vs component inventory.

Correct — Verification at a gate is what turns evidence into a control.

Correct — The Sigstore signing tool for OCI artifacts and more.

Correct — No long-lived private key to manage or leak.

Correct — It binds "who" (an OIDC identity) to an ephemeral signing key.

Correct — It gives public, tamper-evident proof that a signature existed at a point in time.

Correct — You can prove what was signed, by whom, and when — and spot anomalies.

Correct — e.g. "signed by our CI’s workflow identity", not just "signed by someone".

Correct — An attacker’s valid signature is still not YOUR pipeline’s signature.

Correct — One tool signs the artifact and its evidence.

Correct — It removes the key-management burden and a major leak vector.

Correct — Verification can then require "signed by repo X’s release workflow".

Correct — A compromised build can sign a backdoored artifact — provenance addresses build trust.

Correct — The hard parts (key custody, proof of inclusion) are handled for you.

Correct — The "ingredient list" you can query when a new CVE drops.

Correct — The two widely-adopted standardized SBOM formats.

Correct — It catalogs the components present.

Correct — The SBOM is the input; the vuln DB is matched against it.

Correct — Log4Shell showed the cost of not knowing your components.

Correct — It cuts scanner noise by asserting non-exploitable CVEs.

Correct — The hash guarantees the exact bytes, immune to tag mutation.

Correct — Everyone builds against identical dependencies; changes are visible in review.

Correct — e.g. "reqeusts" vs "requests" — installs run attacker code.

Correct — Prevent a public package from shadowing an internal one.

Correct — A data-driven signal for whether a dependency is well-run.

Correct — The SBOM becomes part of the verifiable evidence set, not a side file.

Correct — A tampered or unknown image is rejected before it starts.

Correct — They verify signatures/provenance as a Kubernetes admission gate.

Correct — e.g. "signed by our release workflow AND has SLSA L3 provenance".

Correct — Digest pinning guarantees you run exactly the verified bytes.

Correct — A compromised action/build step can exfiltrate secrets from many downstream repos.

Correct — A SHA is immutable; a tag like @v4 can be moved.

Correct — A compromised job then reaches far less, for far less time.

Correct — Malware cannot linger on a runner reused by the next job.

Correct — Two-person review and gates raise the bar for source tampering.

Correct — Produce AND verify — the gate is what makes the evidence a control.

Correct — Minimize what a compromised step can steal and reuse.

Correct — Only artifacts with the full, verifiable evidence chain run.