Image Provenance is Provenance that identifies the origins, controlled inputs, transformations, tools, actors, environments, and evidence associated with a Machine Image.
Image Provenance may identify installation media, package sources, source revisions, provisioning content, build tools, build environment, security-hardening activities, compliance scans, signatures, integrity values, and provider-specific conversions.
The provenance connects the resulting Machine Image to the Image Baseline and Image Build that produced it.
Within Crucible, Image Provenance supports Traceability, Auditability, Reproducibility, image verification, and controlled deployment.
provenance that identifies the origins, controlled inputs, transformations, tools, actors, environments, and evidence associated with a machine image
Generalized from software supply-chain provenance, build provenance, configuration management, machine-image engineering, and artifact governance and specialized for the Crucible architecture and operational model.
Image Provenance describes how an image came into existence and how it changed. It does not by itself establish that the image is secure, compliant, approved, or suitable for a particular environment.
Provider-specific conversion, upload, signing, promotion, or registration activities may extend the Image Provenance after the original Image Build.
The Image Provenance for a Hardened Image identifies the Red Hat Enterprise Linux (RHEL) 9 installation medium, package repository snapshot, Packer version, Ansible source revision, Security Technical Implementation Guide (STIG) profile, scan results, build environment, cryptographic digest, and cloud-provider image identifier.
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.