Comparison
AttestationvsBuild provenance
Attestation
the scan result, the test outcome and the review approval are each signed statements attached to the artefact's digest.
A signed claim about an artefact, made by whoever performed the check, and verifiable later by anyone. It generalises signing from 'this is ours' to 'this passed the things we require', and it is what makes a policy like 'only run images that have been scanned and approved' enforceable at admission. The chain is only as good as who is trusted to make each claim, so the identities issuing attestations become part of your threat model.
Full entry →Build provenance
you can prove which commit, which builder and which inputs produced this exact image, from a signed statement rather than a wiki page.
A signed record generated by the build system describing what was built, from what source, by which builder, with what inputs. It answers the question a security incident actually asks — where did this artefact come from — without relying on anyone's memory. Its trustworthiness comes from being produced by the build platform rather than by the build script, since a script an attacker controls can claim anything.
Full entry →