SLSA provenance is a build attestation that records where, when, and how software was produced. It usually includes the source repository, build workflow, builder identity, and other metadata that helps link a package release to a specific automated process.
In cyber security, provenance matters because it gives defenders a way to trace a release back to its origin and check whether the build path was legitimate. It is especially useful in supply-chain security, where attackers may try to compromise publishing accounts or CI/CD systems and ship malicious code through an otherwise trusted release process. A valid provenance record can show that a package came from an approved pipeline, but it does not prove the code is harmless. Defenders use provenance alongside code review, build policy, signature checks, and workflow hardening to detect tampering and reduce the risk of poisoned releases.