Build attestation
Also called: SLSA provenance, supply chain attestation
A build attestation is signed metadata describing how an artifact was produced — which source, which builder, which inputs — so consumers can verify its provenance.
A build attestation is a signed statement about how an artifact came to exist: which commit, which builder, which inputs, which steps. It travels alongside the artifact.
A checksum proves a file has not changed. A signature proves who published it. An attestation answers the question neither does — where did this come from? That is the gap supply-chain attacks exploit: a legitimately signed artifact built from tampered inputs.
SLSA defines levels of increasing rigour, from “there is a build log” up to hermetic, reproducible builds on hardened infrastructure. Sigstore and cosign provide the tooling, including keyless signing tied to a CI identity rather than a long-lived private key someone has to guard.