--- title: "Where does your software (really) come from?" url: https://daily.dev/posts/where-does-your-software-really-come-from--teqztv55j source_url: https://github.blog/2024-04-30-where-does-your-software-really-come-from/ type: article source: "GitHub Blog" published: 2024-04-30T16:36:09.850Z updated: 2024-05-09T07:52:51.999Z tags: ["supply-chain"] reading_time: 6 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Where does your software (really) come from? **[GitHub Blog](https://daily.dev/sources/ghblog)** · 6 min read · 0 upvotes · 0 comments ## Summary Software artifacts go through a production lifecycle and it's important to have visibility into this lifecycle for security purposes. Digests or hashes can be used to verify the integrity of files. Asymmetric encryption is used for trust on the internet. Mechanisms like signatures and provenance attestations help ensure a trusted origin for software artifacts. The SLSA project provides a standardized schema for provenance attestations. Sigstore simplifies software signatures and provides a tamper-proof paper trail for artifacts. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Don’t just attend KubeCon \+ CloudNativeCon, Merge Forward your experience\!](https://daily.dev/posts/don-t-just-attend-kubecon-cloudnativecon-merge-forward-your-experience--l0rpp73x8) · CNCF · 0 upvotes · 0 comments - [Announcing H2 2026 KCDs](https://daily.dev/posts/announcing-h2-2026-kcds-m96goajm1) · CNCF · 1 upvotes · 0 comments - [Two months of Open Community Groups](https://daily.dev/posts/two-months-of-open-community-groups-asf52zhbs) · CNCF · 0 upvotes · 0 comments --- Tags: [#supply-chain](https://daily.dev/tags/supply-chain) [View this post on daily.dev](https://daily.dev/posts/where-does-your-software-really-come-from--teqztv55j)