--- title: Where does your software (really) come from? | daily.dev description: Software artifacts go through a production lifecycle and it's important to have visibility into this lifecycle for security purposes. Digests or hashes can be... canonical: https://daily.dev/posts/where-does-your-software-really-come-from--teqztv55j twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Where does your software (really) come from? | daily.dev og:description: Software artifacts go through a production lifecycle and it's important to have visibility into this lifecycle for security purposes. Digests or hashes can be... og:url: https://daily.dev/posts/where-does-your-software-really-come-from--teqztv55j og:image: https://api.daily.dev/og/posts/tEqZtv55j.png og:image:alt: Where does your software (really) come from? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Where does your software (really) come from? **[GitHub Blog](https://daily.dev/sources/ghblog)** · 6 min read · 0 upvotes · 0 comments ## Summary Software artifacts go through a production lifecycle and it's important to have visibility into this lifecycle for security purposes. Digests or hashes can be used to verify the integrity of files. Asymmetric encryption is used for trust on the internet. Mechanisms like signatures and provenance attestations help ensure a trusted origin for software artifacts. The SLSA project provides a standardized schema for provenance attestations. Sigstore simplifies software signatures and provides a tamper-proof paper trail for artifacts. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#supply-chain](https://daily.dev/tags/supply-chain) [View this post on daily.dev](https://daily.dev/posts/where-does-your-software-really-come-from--teqztv55j) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Where does your software (really) come from?","url":"https://daily.dev/posts/where-does-your-software-really-come-from--teqztv55j","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/where-does-your-software-really-come-from--teqztv55j"},"datePublished":"2024-04-30T16:36:09.850Z","dateModified":"2024-05-09T07:52:51.999Z","description":"Software artifacts go through a production lifecycle and it's important to have visibility into this lifecycle for security purposes. Digests or hashes can be...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d9f696d94260c259c8bec302a450b5fb?_a=AQAEuiZ","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d9f696d94260c259c8bec302a450b5fb?_a=AQAEuiZ","isAccessibleForFree":true,"articleSection":"GitHub Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"GitHub Blog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/106cf162b88840808484d4b5429b59b1","url":"https://daily.dev/sources/ghblog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/where-does-your-software-really-come-from--teqztv55j","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"supply-chain","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"GitHub Blog","item":"https://daily.dev/sources/ghblog"},{"@type":"ListItem","position":3,"name":"Where does your software (really) come from?"}]} ```