XIV

Verify the artifact

The artifact carries provenance and a signature, and the check that admits it runs before apply and fails closed.

confidencetransparency

Deploy time is too late to check. The artifact carries provenance and a signature, and the check that admits it runs before apply and fails closed.