Term Kind Topic What it is
Build Attestation concept Supply-Chain Provenance A signed statement about how an artifact was produced — by which builder from which source — that a deployment gate can verify rather than trust.
Release Tarball Divergence Archive-Repository Gap, Distributed-Source Divergence concept Supply-Chain Provenance The gap between a project's reviewed source repository and the source archive that downstream actually builds, which is a trust boundary most supply-chain controls assume does not exist.