# Build provenance

> Signed metadata describing how an artifact was produced: from what sources, by which builder, with which inputs.

**Build provenance** is verifiable metadata about an artifact's origin. It records what was built, from which source revision, by which build system, using which inputs and parameters — and it is signed, so a consumer can check the claim rather than take it on trust.

It answers a different question from the two artifacts it is usually shipped alongside. An [SBOM](https://primcoat.app/glossary/sbom) says *what is inside* the artifact. A [signature](https://primcoat.app/glossary/cosign) says *this artifact has not been altered since it was signed*. Provenance says *this artifact was produced by that pipeline, from that commit* — which is what lets you reject a binary that is perfectly well-formed and correctly signed by someone, but did not come from your build system.

The dominant format is **in-toto** attestations (in-toto is an open framework for securing software supply chains, and the format [SLSA](https://primcoat.app/glossary/slsa) specifies for provenance), typically signed with [Cosign](https://primcoat.app/glossary/cosign) and distributed alongside the artifact.

For a virtual machine image, provenance is what connects the image you are about to boot in production back to a specific upstream base image and a specific build — so that "where did this [AMI](https://primcoat.app/glossary/ami) come from?" has an answer that does not depend on anybody's memory.

## Related

- https://primcoat.app/glossary/slsa.md
- https://primcoat.app/glossary/cosign.md
- https://primcoat.app/glossary/sbom.md

---

Source: https://primcoat.app/glossary/provenance
Primcoat — a managed VM image factory. https://primcoat.app