A build system compiles source into one artifact and that same artifact fans out to every downstream destination — "build once, deployed everywhere." If an attacker compromises the build step itself, the resulting artifact is malicious from that point on, and an undefended pipeline auto-deploys it to all destinations simultaneously, without needing to compromise each one individually.
A provenance-gated pipeline instead signs each artifact with the exact source-commit hash that produced it. Before running it, every destination checks that hash against an approved-commit allow-list. A compromised build still produces a validly-signed artifact — but if the source commit itself isn't on the approved list, the signature check fails and the gate blocks deployment, even though the build system was fully trusted at signing time.
deploy(artifact) →
if mode == gated:
accept = approvedCommits.has(artifact.commitHash)
else:
accept = true
if accept: destination.run(artifact)
else: destination.block(artifact)
- Compromise Build System — simulates an attacker injecting malicious code during the build step; the artifact's commit hash flips to one that was never reviewed or approved.
- Undefended — every destination blindly trusts whatever the central build system hands it.
- Provenance-gated — each destination independently re-checks the commit-hash attestation before running anything.
- Run the identical compromise event in both modes to see how the same build-system breach reaches 100% of destinations undefended, but 0% once provenance checks gate every deployment.
Real-world relevance: this is the core idea behind SLSA provenance, in-toto attestations and admission-control signature verification — the build system is trusted, but every consumer still re-verifies exactly which source produced what it's about to run.