Build Security

Verify Build Provenance Before Trusting Artifacts

A release artifact can have the expected filename, version, and download location without being the artifact your release process was supposed to produce. A compromised publishing account, an unexpected build path, or a mistake in release automation can put different bytes in front of users while everything around those bytes still looks familiar. Checking an artifact’s hash helps answer whether the bytes changed relative to a known hash. It does not, by itself, answer where that hash came from or whether those bytes were built from the intended source by an approved build process.