Artifact signing, SBOM, and provenance

Build artifacts are signed before they are promotable. The signature binds the artifact to the build that produced it, so a deploy can verify it is shipping exactly what the pipeline built. Unsigned artifacts are not promotable.

Each signed artifact ships with a software bill of materials — the components and dependencies that went into it — so you can audit what is inside an image and answer supply-chain questions without guessing.

NOME records build provenance: what ran, on which runner, from which commit, with which inputs. Provenance plus signature plus SBOM is the evidence chain the deploy gate checks.

At the deploy gate, an artifact that is unsigned, has a broken signature, or lacks verifiable provenance fails closed — the deploy does not proceed and the reason is reported. NOME never promotes an artifact it cannot verify.