Sub-module
Software Supply-Chain Provenance
Bind source, build, dependencies, SBOM, scans, signatures and attestations to each artifact.
How the capability changes the workflow
Bind source, build, dependencies, SBOM, scans, signatures and attestations to each artifact.
Teams can determine exactly what produced a release and which deployments inherit a risk.
Capability contract
- BehaviorBind source, build, dependencies, SBOM, scans, signatures and attestations to each artifact.
- OutcomeTeams can determine exactly what produced a release and which deployments inherit a risk.
- BoundaryA scan result alone cannot approve promotion.
- SourceHaephestus Part 03