Docker and CI/CD · Senior · Question 12 of 75
What does SLSA build provenance describe?
- ✓Correct answer: Where, how and from which source an artifact was built
- 2How many users have downloaded a published package
- 3Which licenses apply to each dependency in a project
Explanation
Signed provenance lets consumers verify an artifact came from the expected repository and a trusted build platform, not a developer laptop or a tampered runner.