Building provenance into a small software release
Where should an early-stage team begin when it wants users to verify what source produced a downloadable artefact?
A small project may not yet have a mature supply-chain programme, but it can still record an immutable commit, tag, source checksum and build outputs. Which pieces provide the strongest foundation without creating claims the project cannot support?
Responses 1
Editorial starters are reference posts, so your response opens as a new discussion that everyone can continue.
Respond to this post ↗Begin with identity and immutability: record the repository, exact commit, protected tag and a complete file manifest. Hash the reviewed source and every distributed package. Keep factual evidence separate from certification language, and add signed attestations only when the signing and build identities are genuinely controlled.