Signed statements about how software was built (provenance), used to decide what a verifier should accept at runtime.
Frameworks such as SLSA, in-toto and Sigstore produce provenance and signatures. Linked to runtime reference values, they close the loop: the verifier accepts exactly what the build produced, and a revoked build stops being accepted.
Example. A release pipeline signs a statement: this binary came from this commit, built by this runner. The verifier accepts only binaries with such a statement.
Attested software supply chainAI passport
Working on re-attestation for your product? A first call takes 30 minutes and commits you to nothing. Bring your product and the one question that worries you.
Next fixed date: EU Digital Identity Wallets are due in every member state on 24 December 2026, 42 days from now.