noCV
BARTIF-102 · Identify immutable artifacts

Record build inputs without exposing build secrets

Practice briefTaskIntermediate

Provenance output includes all build environment variables.

Focused work estimate
2h 30m + prerequisites
Priority in the scenario
High
Engineering practice
Supply-chain integrity

Estimated field mix

  • Security60%
  • Developer tooling40%

Field percentages are editorial estimates of the ticket's engineering focus. They total 100%; they are not measured time, proficiency scores, or ownership evidence.

Your next step

Review it, then add it to your workspace.

The board opens an editable draft; nothing is saved until you confirm it. Sign-in and workspace permissions apply, and Demo boards remain ephemeral.

Use in my work boardView project and downloads

Project context

A fictional application team deploys mutable image tags and cannot reliably identify the artifact running during an incident.

Setup prerequisites

  • Author synthetic artifact manifests and a local registry double; do not pull or execute untrusted images.

Preceding work

Complete these dependencies, or supply their agreed outputs before taking this ticket.

Acceptance criteria

  • Record source revision, builder version, and declared inputs.
  • Exclude secrets and workstation paths.
  • Bind provenance to the exact artifact digest.

Implementation constraints

  • Use allowlisted metadata rather than environment dumps.

Verification to include

  • Verify a complete synthetic provenance record.
  • Reject mismatched digest and detect seeded secret leakage.

Deliverables

  • Provenance manifest.

Rollout and recovery

Block promotion when required provenance is missing.

Value of the work

For the engineer: Practice artifact identity, promotion policies, and release provenance.

For the team: Provide reproducible deployments and a clear path to withdraw defective artifacts.

Evidence boundaries

Outcome Evidence: Tests, patches, and runbooks are requested deliverables. They become Outcome Evidence only through a qualified Mission and immutable Evidence IDs.

Ownership Evidence: Independent adaptation must be observed under a declared verification policy and cite immutable Evidence IDs. Completing a planning ticket establishes no Ownership Evidence.