The plain-English version
Information connecting an artifact with its source and build process.
Why it matters
It helps establish which inputs and process produced the file being deployed.
Let’s make it click
A release record connects an image digest with a source commit and build workflow.
Vibe Bro’s heads-up
A filename or mutable tag alone does not prove origin; verify the actual artifact and the trustworthiness of its provenance mechanism.
The docs behind it
Documentation links checked .
Editorial review · October 28, 2026
Supported: Build provenance connects artifact, inputs, and builder/process; its trustworthiness must still be verified.