skills.rest
jassics
jassicsCOMMUNITY
Explore all skills by this author →
Website𝕏@jassicsGitHub

artifact-provenance-verification

Verify build artifact provenance and integrity using SLSA guidelines.

6|Updated May 30, 2026
Search Tags:#build process#SLSA#build integrity#security verification#artifact provenance
One-click install
npx skills add https://github.com/jassics/awesome-claude-security --skill artifact-provenance-verification
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: artifact-provenance-verification
Source: https://github.com/jassics/awesome-claude-security/tree/main/plugins/supply-chain-security/skills/artifact-provenance-verification
Command: npx skills add https://github.com/jassics/awesome-claude-security --skill artifact-provenance-verification

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill helps in assessing and establishing the provenance and integrity of build artifacts, ensuring that only verified and attested artifacts are deployed, thus mitigating risks from tampered or unknown-origin artifacts.

Core Features & Use Cases

  • Provenance Assessment: Evaluates the maturity of an artifact's provenance and integrity.
  • SLSA Mapping: Maps the build/artifact flow to the SLSA (Software Bill of Materials) build level.
  • Verification Steps: Guides through the verification process, from inventorying trust signals to enforcing verification at admission/deploy.
  • Use Case: For an organization looking to implement a robust security strategy, this Skill can be used to ensure that all deployed artifacts are from trusted sources and have not been tampered with.

Quick Start

Use the artifact-provenance-verification skill to assess the provenance of the 'latest-image.tar.gz' artifact.

Frequently Asked Questions about artifact-provenance-verification

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify artifact provenance and build integrity before deployment?▼

Artifact provenance verification checks an artifact's signing identity, validates its build provenance, and enforces verification at admission gates to ensure only properly signed and attested builds are deployed.

What is SLSA build level mapping and how does it assess artifact security?▼

SLSA build level mapping evaluates the maturity of an artifact's provenance and integrity by mapping the build flow to SLSA guidelines, ensuring artifacts originate from known sources and have not been tampered with.

How do I enforce artifact signing identity checks at deployment admission gates?▼

Enforcing artifact signing identity at admission gates requires inventorying trust signals, validating provenance attestation, and blocking deployment of unverified or unknown-origin artifacts during the admission process.

Can I assess the provenance maturity of a specific build artifact like a tar.gz file?▼

Yes, you can assess provenance maturity of specific build artifacts like tar.gz files by evaluating their signing identity, verifying provenance attestation, and mapping the build process to SLSA levels.

What steps are needed to inventory trust signals for secure artifact deployment?▼

Inventorying trust signals involves cataloging artifact signing identities, collecting provenance attestations, and mapping build integrity metadata to SLSA guidelines before enforcing verification at deployment gates.

Why does artifact provenance verification matter for secure software deployment?▼

Artifact provenance verification mitigates risks from tampered or unknown-origin artifacts by ensuring only verified and attested builds from trusted sources are deployed, establishing a robust software security strategy.

Related Skills

Explore More Software Engineering Skills→
Sir-chawakornSir-chawakorn
9

supply-chain-sbom-provenance

Generate and validate SBOMs, sign artifacts, and emit SLSA build provenance.

Community
Advanced
ucirelloucirello
2

deployment

Automate software artifact deployment with pre-deployment gates and rollback planning.

Community
Advanced
spallempatispallempati

ci-build-integrity

Enforce immutable CI builds and generate signed SBOMs for supply chain security.

Community
Advanced
jaskaranhundaljaskaranhundal
3

build-integrity

Verify build artifact signatures, reproducibility, and pipeline security against tampering.

Community
Advanced