[Verse 1] When you build your software stack today Every tool and step along the way Leaves a trace that tells the story true Of how your artifacts came through Compiler versions, environment state Build machines and timestamp date Capture all before it slips away For supply chain visibility [Chorus] Build, Trace, Know - where your code has been Build, Trace, Know - every tool within Metadata and provenance combined Transparency by design Build, Trace, Know - make your SBOM complete Build, Trace, Know - from source to concrete Chronicle the journey, document the flow Build, Trace, Know [Verse 2] Docker images, language runtime Operating system, build-time Dependencies pulled from registries Hash values for integrity Who signed the code, what key was used Was the build process ever abused Geographic location, cloud or on-prem Chain of custody, end to end [Chorus] Build, Trace, Know - where your code has been Build, Trace, Know - every tool within Metadata and provenance combined Transparency by design Build, Trace, Know - make your SBOM complete Build, Trace, Know - from source to concrete Chronicle the journey, document the flow Build, Trace, Know [Bridge] From commit hash to final release Every step increases the peace Of mind that comes with knowing how Your software got to where it's now SLSA levels, attestations signed Leave no black box behind [Verse 3] Generate your provenance at build time Store it in a format standardized Link it to your software bill of sale So the audit trail will never fail When threats emerge or zero-days strike You'll know exactly what's alike Complete visibility from start to end Your supply chain you can defend [Chorus] Build, Trace, Know - where your code has been Build, Trace, Know - every tool within Metadata and provenance combined Transparency by design Build, Trace, Know - make your SBOM complete Build, Trace, Know - from source to concrete Chronicle the journey, document the flow Build, Trace, Know [Outro] In a world of complex software chains Provenance is what remains Your shield against the unknown threat Build, Trace, Know - don't forget
← Component Identity: Names, Versions, and Hashes | Vendored Code and Forks: Complex Dependency Scenarios →