Tracing provenance means being able to say, for each component in your software, what it is, where it came from, who built it, how, and from which source. In practice you combine an SBOM for the "what," signed build provenance for the "how," and policy checks that compare the two.
What is provenance, exactly?
SLSA defines provenance as a record of how a package artifact was built. It describes what entity built the artifact, what process they used and what the inputs were. Consumers compare the actual provenance with what they expect.
That is different from an SBOM. An SBOM lists contents. Provenance describes the journey. You need both to claim lineage.
What do SLSA levels say about it?
SLSA's build track has levels. At level 0 nothing is guaranteed. At level 1, provenance exists, but it may be incomplete or unsigned and is easy to forge. At level 2, builds run on a hosted platform that signs the provenance, making tampering after the build harder, and the platform is not an individual's workstation. At level 3, the build platform has strong protection against tampering during the build: runs cannot influence one another, and signing secrets are kept away from user-defined build steps.
Level 3 on your own builds does not tell you about the open source libraries you pull in. For those you depend on what upstream publishes.
What is in-toto's role?
in-toto is a CNCF graduated framework that aims to make clear what steps were performed, by whom and in what order, from start to installation. Its metadata standard lets each step in a pipeline emit a signed statement that a later step or a consumer can verify.
CycloneDX also lists attestations among its capabilities, alongside SBOM, VEX and BOM types for services, machine learning and cryptography. Your format choice matters less than that tools can read it.
Where does lineage usually break?
Three places. Vendored code is copied into a repository and loses its origin. Container base images carry operating system packages the application SBOM never lists. And rebuilt or mirrored artifacts lose the link to the upstream tag.
A constructed example
A team ships a service built from a base image, 140 npm packages and one vendored C parser. For the npm packages, the lock file and registry give names and hashes. For the base image, an image SBOM lists the OS packages. The vendored parser has a comment saying "from some project, 2019." The team traces it to an upstream tag by comparing file hashes, records the tag and commit in the SBOM, and adds a policy that rejects vendored code without an origin field.
How to check or apply this
- Generate an SBOM from the built artifact, covering OS packages, language packages and vendored code.
- Record a hash for each component, and the source repository and version where known.
- Build on a hosted, ephemeral platform and publish signed provenance for your own releases, aiming for SLSA level 2 first.
- Verify provenance and signatures before deploying, and fail closed if they are missing for artifacts that should have them.
- For vendored code, require an origin record.
- Store SBOMs and provenance together, indexed by release.
- Review gaps quarterly: which components still have unknown origin.
Safeguard can generate SBOMs and inventory your dependencies, which gives you the "what" half. Provenance signing depends on your build platform.
Open the dependency inventory demo in its own page.
How far do you need to go?
Not every component needs full provenance on day one. Start with the ones that run with privilege, touch the network or hold secrets. For the long tail, a hash and a source URL in the SBOM is a reasonable first step. Improve coverage where an incident or an audit shows a gap, and record unknowns openly so no one assumes they are verified.
Quick check
Is an SBOM the same as provenance?
No. An SBOM lists what is in software. Provenance records how an artifact was built, by whom and from which inputs.
What is the first SLSA level worth aiming for?
Level 2 for most teams. It uses a hosted build platform that signs provenance, which makes tampering after the build harder.
Sources
Last reviewed: 18 October 2026.
