Image Provenance

Go up to Terms and Definitions

Discussion

Image Provenance is Provenance that identifies the origins, controlled inputs, transformations, tools, actors, environments, and evidence associated with a Machine Image.

Image Provenance may identify installation media, package sources, source revisions, provisioning content, build tools, build environment, security-hardening activities, compliance scans, signatures, integrity values, and provider-specific conversions.

The provenance connects the resulting Machine Image to the Image Baseline and Image Build that produced it.

Within Crucible, Image Provenance supports Traceability, Auditability, Reproducibility, image verification, and controlled deployment.

Definition

provenance that identifies the origins, controlled inputs, transformations, tools, actors, environments, and evidence associated with a machine image

Source

Generalized from software supply-chain provenance, build provenance, configuration management, machine-image engineering, and artefact governance and specialized for the Crucible architecture and operational model.

Note

Image Provenance describes how an image came into existence and how it changed. It does not by itself establish that the image is secure, compliant, approved, or suitable for a particular environment.

Provider-specific conversion, upload, signing, promotion, or registration activities may extend the Image Provenance after the original Image Build.

Example

The Image Provenance for a Hardened Image identifies the Red Hat Enterprise Linux (RHEL) 9 installation medium, package repository snapshot, Packer version, Ansible source revision, Security Technical Implementation Guide (STIG) profile, scan results, build environment, cryptographic digest, and cloud-provider image identifier.

© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.