Knowing where an image came from.
WHY IT MATTERS
Deploying an image means running whatever it contains.
WHAT PROVENANCE ANSWERS
Which source produced it Which pipeline built it What went into it Whether it was altered since
WHAT TO RECORD IN THE IMAGE ITSELF
Labels naming the source commit, the build, and the version.
WHY LABELS
They travel with the image and survive being copied.
WHAT SIGNING ADDS
Proof it came from your pipeline.
WHAT VERIFICATION ADDS
Refusing to run anything not signed.
WHERE VERIFICATION IS ENFORCED
An admission policy.
WHAT A BILL OF MATERIALS ADDS
A list of everything inside.
WHAT THAT ANSWERS
Whether you are affected by a newly announced vulnerability.
WHY THAT QUESTION ARRIVES URGENTLY
Announcements affect widely used components, and everyone asks at once.
WHAT TO AUTOMATE
Generating and storing it with every build.
WHAT TO BE ABLE TO ANSWER IN MINUTES
Which images contain a given component Which of those are deployed Where
WHAT THAT REQUIRES
An inventory of what is running.
WHAT TO MAINTAIN
That inventory, automatically.
WHAT TO AVOID
Deploying images nobody can trace.
