https://nalar.dev/tags/provenance/ Recent content in Provenance on Nalar Hugo en-us Sat, 05 Sep 2026 00:00:00 +0700 https://nalar.dev/verify-build-provenance-before-trusting-artifacts/ Sat, 05 Sep 2026 00:00:00 +0700 https://nalar.dev/verify-build-provenance-before-trusting-artifacts/ <p>A release artifact can have the expected filename, version, and download location without being the artifact your release process was supposed to produce. A compromised publishing account, an unexpected build path, or a mistake in release automation can put different bytes in front of users while everything around those bytes still looks familiar.</p> <p>Checking an artifact&rsquo;s hash helps answer whether the bytes changed relative to a known hash. It does not, by itself, answer where that hash came from or whether those bytes were built from the intended source by an approved build process.</p>