Chain-of-Custody Evidence

chain-of-custody

Artifact-bound evidence that links released artifacts to declared source/build lineage with explicit verification state.

Decision Context

Evidence required: Artifact digests plus provenance statement and signature material; optional SBOM and builder claims.

Decision impact: Missing custody can warn or freeze depending on risk level; invalid custody bindings always freeze.

Linked CRABS Tags

CRABS-S80, CRABS-S81, CRABS-S82, CRABS-S83, CRABS-S84, CRABS-S85, CRABS-S86

Linked DAD Rules

DAD-CRT-80, DAD-CRT-81, DAD-WRN-80, DAD-WRN-81

Reference model for provenance and attestation claims.

Level framing used as claimed custody strength tiers.

Verification baseline for builder identity and signature checks.

Artifact-bound distribution model for provenance artifacts.