Modern applications combine source code, packages, container images, generated code, and remote services. When one of those inputs changes, we need to know which builds used it and which results support accepting the output.

The assembly line reality

An SBOM describes components. Provenance describes a recorded build and its inputs and output. Neither is automatically complete. Their value depends on the producer, the scope of observation, and whether the record is associated with the artifact actually being used.

The trust problem

A dependency manifest can describe what a developer intended to use. A build record can describe what the producer observed. A deployment record can describe what was delivered. Those are separate claims, and the identifiers connecting them matter.

A binary digest identifies bytes. It is not the identity of the human or agent that produced them, and it is not a verdict that the software is safe.

Build records and traceability

Capture the relevant inputs and outputs while the build runs. Retain the signed evidence and query it using artifact identifiers. When records from multiple steps share a verified artifact binding, a reviewer can follow the recorded path through the supply chain.

This does not reconstruct history that was never captured. Nor does a provenance store alone identify every service affected by a CVE: that also requires component identification, vulnerability intelligence, and a reliable deployment inventory.

Supporting NIST SP 800-53 SR-4

Provenance evidence can support a supply-chain provenance requirement. The control owner must decide which components and lifecycle stages are in scope, what information is required, and how records are retained and validated. Using an attestation format does not by itself satisfy the complete control.

From a record to a decision

A reviewer should be able to ask where the evidence came from, which artifact it describes, which identity signed it, and what verification policy accepted it. An observed agent label or a timestamp is not a substitute for authenticated identity or independent observation.

CI/lock captures the work. Pushgate checks the push. The platform manages gates and technical control evidence. The trust architecture explains the assumptions behind those records. Originally published on LinkedIn.