====== Image Provenance ======

[[dido:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]]

===== Discussion =====

Image Provenance is [[dido:99_annexes:annex-b-terms-and-definitions:p:provenance|Provenance]] that identifies the origins, controlled inputs, transformations, tools, actors, environments, and evidence associated with a [[dido:99_annexes:annex-b-terms-and-definitions:m:machine_image|Machine Image]].

Image Provenance may identify installation media, package sources, source revisions, provisioning content, build tools, build environment, security-hardening activities, compliance scans, signatures, integrity values, and provider-specific conversions.

The provenance connects the resulting Machine Image to the [[dido:99_annexes:annex-b-terms-and-definitions:i:image_baseline|Image Baseline]] and [[dido:99_annexes:annex-b-terms-and-definitions:i:image_build|Image Build]] that produced it.

Within Crucible, Image Provenance supports [[dido:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]], [[dido:99_annexes:annex-b-terms-and-definitions:a:auditability|Auditability]], [[dido:99_annexes:annex-b-terms-and-definitions:r:reproducibility|Reproducibility]], image verification, and controlled deployment.

===== Definition =====

//[[dido:99_annexes:annex-b-terms-and-definitions:p:provenance|provenance]] that identifies the origins, controlled inputs, transformations, tools, actors, environments, and evidence associated with a [[dido:99_annexes:annex-b-terms-and-definitions:m:machine_image|machine image]]//

===== Source =====

Generalized from software supply-chain provenance, build provenance, configuration management, machine-image engineering, and artifact governance and specialized for the Crucible architecture and operational model.

===== Note =====

Image Provenance describes how an image came into existence and how it changed. It does not by itself establish that the image is secure, compliant, approved, or suitable for a particular environment.

Provider-specific conversion, upload, signing, promotion, or registration activities may extend the Image Provenance after the original Image Build.

===== Example =====

The Image Provenance for a Hardened Image identifies the [[dido:99_annexes:annex-b-terms-and-definitions:r:rhel]] 9 installation medium, package repository snapshot, Packer version, Ansible source revision, [[dido:99_annexes:annex-b-terms-and-definitions:s:stig]] profile, scan results, build environment, cryptographic digest, and cloud-provider image identifier.

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>