| Both sides previous revision Previous revision | |
| public:99_annexes:annex-b-terms-and-definitions:i:image_provenance [2026/09/12 17:42] – ↷ Page moved from private:99_annexes:annex-b-terms-and-definitions:i:image_provenance to public:99_annexes:annex-b-terms-and-definitions:i:image_provenance nick_dido | public:99_annexes:annex-b-terms-and-definitions:i:image_provenance [2026/09/12 17:43] (current) – ↷ Links adapted because of a move operation nick_dido |
|---|
| ====== Image Provenance ====== | ====== Image Provenance ====== |
| |
| [[private:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]] | [[public:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]] |
| |
| ===== Discussion ===== | ===== Discussion ===== |
| |
| Image Provenance is [[private:99_annexes:annex-b-terms-and-definitions:p:provenance|Provenance]] that identifies the origins, controlled inputs, transformations, tools, actors, environments, and evidence associated with a [[private:99_annexes:annex-b-terms-and-definitions:m:machine_image|Machine Image]]. | Image Provenance is [[public:99_annexes:annex-b-terms-and-definitions:p:provenance|Provenance]] that identifies the origins, controlled inputs, transformations, tools, actors, environments, and evidence associated with a [[public:99_annexes:annex-b-terms-and-definitions:m:machine_image|Machine Image]]. |
| |
| Image Provenance may identify installation media, package sources, source revisions, provisioning content, build tools, build environment, security-hardening activities, compliance scans, signatures, integrity values, and provider-specific conversions. | Image Provenance may identify installation media, package sources, source revisions, provisioning content, build tools, build environment, security-hardening activities, compliance scans, signatures, integrity values, and provider-specific conversions. |
| |
| The provenance connects the resulting Machine Image to the [[private:99_annexes:annex-b-terms-and-definitions:i:image_baseline|Image Baseline]] and [[private:99_annexes:annex-b-terms-and-definitions:i:image_build|Image Build]] that produced it. | The provenance connects the resulting Machine Image to the [[public:99_annexes:annex-b-terms-and-definitions:i:image_baseline|Image Baseline]] and [[public:99_annexes:annex-b-terms-and-definitions:i:image_build|Image Build]] that produced it. |
| |
| Within Crucible, Image Provenance supports [[private:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]], [[private:99_annexes:annex-b-terms-and-definitions:a:auditability|Auditability]], [[private:99_annexes:annex-b-terms-and-definitions:r:reproducibility|Reproducibility]], image verification, and controlled deployment. | Within Crucible, Image Provenance supports [[public:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]], [[public:99_annexes:annex-b-terms-and-definitions:a:auditability|Auditability]], [[public:99_annexes:annex-b-terms-and-definitions:r:reproducibility|Reproducibility]], image verification, and controlled deployment. |
| |
| ===== Definition ===== | ===== Definition ===== |
| |
| //[[private:99_annexes:annex-b-terms-and-definitions:p:provenance|provenance]] that identifies the origins, controlled inputs, transformations, tools, actors, environments, and evidence associated with a [[private:99_annexes:annex-b-terms-and-definitions:m:machine_image|machine image]]// | //[[public:99_annexes:annex-b-terms-and-definitions:p:provenance|provenance]] that identifies the origins, controlled inputs, transformations, tools, actors, environments, and evidence associated with a [[public:99_annexes:annex-b-terms-and-definitions:m:machine_image|machine image]]// |
| |
| ===== Source ===== | ===== Source ===== |
| ===== Example ===== | ===== Example ===== |
| |
| The Image Provenance for a Hardened Image identifies the [[private:99_annexes:annex-b-terms-and-definitions:r:rhel]] 9 installation medium, package repository snapshot, Packer version, Ansible source revision, [[private:99_annexes:annex-b-terms-and-definitions:s:stig]] profile, scan results, build environment, cryptographic digest, and cloud-provider image identifier. | The Image Provenance for a Hardened Image identifies the [[public:99_annexes:annex-b-terms-and-definitions:r:rhel]] 9 installation medium, package repository snapshot, Packer version, Ansible source revision, [[public:99_annexes:annex-b-terms-and-definitions:s:stig]] profile, scan results, build environment, cryptographic digest, and cloud-provider image identifier. |
| |
| ---- | ---- |