<p>You have 2 questions here that likely need two different answers.  Luckily, both are solved problems!</p>
<ol>
<li><p><strong>How to prove the provenance of code?</strong>. - this is done with what's called Code Signing.  Azure DevOps has tools for this - KeyVault and Pipelines  can both do it, I suspect there are others.</p>
</li>
<li><p><strong>How to prove that a package contains the code it's supposed to contain?</strong>. The best and most predictable way to do this is likely with an MD5 checksum.</p>
</li>
</ol>

CC BY-SA 4.0
2021-08-17T15:04:05.017Z
2021-08-17T15:04:05.017Z
esoterydactyl
<p>While this question could be posed in a vendor agnostic fashion - I'll gear it around Github and Azure to give it some context.</p>

<p>I am planning an open-source project, in a sensitive business domain (banking). As such, I feel it would be important for users who download and install it to be able to verify the provenance of the binary - through some kind of independently tracked "chain of custody" - tracing it back to the actual source code label that the CI process consumed.</p>

<p>How is this currently achieved? If at all? Are there any known mechanisms/practices for this?</p>

<p>What I imagine, is a publicly visible landing page in Azure DevOps, hosted by Microsoft (unable to tampered by anyone, not even the project owner) - which maps the installation binary hash to the source control label thumbprint. This would allow the user to trust that the binary in their possession is guaranteed to be the product of the code they are auditing.</p>

CC BY-SA 4.0
2021-08-17T19:59:28.110Z
Realized this was posted 2+ years ago, but we built a tool during this time to solve this - Reliza Hub - which binds source code to artifacts and stores all metadata separately which can be used among other things for audit purposes.
taleodor
<release-management>
Validating release artifact provinence
Adam
# Validating release artifact provinence

(Asked by: username_0 on 2019-04-17)

While this question could be posed in a vendor agnostic fashion - I'll gear it around Github and Azure to give it some context.

I am planning an open-source project, in a sensitive business domain (banking). As such, I feel it would be important for users who download and install it to be able to verify the provenance of the binary - through some kind of independently tracked "chain of custody" - tracing it back to the actual source code label that the CI process consumed.

How is this currently achieved? If at all? Are there any known mechanisms/practices for this?

What I imagine, is a publicly visible landing page in Azure DevOps, hosted by Microsoft (unable to tampered by anyone, not even the project owner) - which maps the installation binary hash to the source control label thumbprint. This would allow the user to trust that the binary in their possession is guaranteed to be the product of the code they are auditing.

**Tags:** release-management

> **Comments:**
> **username_1**: Realized this was posted 2+ years ago, but we built a tool during this time to solve this - Reliza Hub - which binds source code to artifacts and stores all metadata separately which can be used among other things for audit purposes.  

---

## 1 answers

### Answer by username_2 on 2021-08-17. Score: 1

You have 2 questions here that likely need two different answers. Luckily, both are solved problems!

1. **How to prove the provenance of code?**. - this is done with what's called Code Signing. Azure DevOps has tools for this - KeyVault and Pipelines can both do it, I suspect there are others.
2. **How to prove that a package contains the code it's supposed to contain?**. The best and most predictable way to do this is likely with an MD5 checksum.


---

