Build verifiable artifacts
Record provenance and signatures
Attach verifiable information about source, builder, workflow, and artifact identity so consumers can check where a release came from.
8 minute lesson
A checksum detects change only when the expected checksum arrives through a trusted channel. Provenance connects the artifact to its build process.
Generate attestations inside the trusted builder and sign through a protected identity or key. Consumers must verify the signature, expected project, source, builder, and artifact digest. A valid signature from the wrong workflow is not enough.
An attacker signs a package from a personal workflow using a valid identity. The signature verifies mathematically, but the artifact did not come from the protected release workflow or approved source revision.
Verification therefore needs policy. Check the artifact digest, expected project, source revision, builder identity, and workflow, not only the presence of a signature.
Choose one release artifact and write the exact provenance policy a consumer should enforce. Save a successful verification showing its subject digest, source revision, and builder identity. Then verify a valid attestation from an unapproved branch or builder and prove the policy rejects it.
Lesson completed