A trustworthy dependency inventory needs more than package names. Provenance records should connect the component source, exact release or commit, retrieval channel, build or package artifact and the product release that used it.
Provenance Supports CRA Due Diligence
Article 13 requires due diligence for third-party components. Knowing the actual source and release of a dependency helps teams determine whether they assessed the same component that later entered the product build.
Record Where the Component Came From
Capture the repository, package registry, supplier or build source used to obtain the component. This reduces ambiguity where similarly named or unofficial packages exist.
Record Exact Version or Commit Identity
Version numbers, commit hashes or equivalent release identifiers help tie vulnerability and support information to the exact component included in the product.
Connect Source to Build Artifact
Where feasible, preserve the relationship between assessed source and the binary, package or firmware artifact used in the build. This is especially important for precompiled or supplier-generated components.
Use Integrity and Signature Evidence Where Available
Checksums, signatures and authenticated distribution channels can strengthen confidence that the retrieved component has not been substituted or altered unexpectedly. The appropriate mechanism depends on the ecosystem and risk.
Feed Provenance Into the SBOM
SBOM data becomes more useful when component identity is stable and traceable to a known source. Provenance data can help resolve duplicate or ambiguous packages and improve vulnerability matching.
Preserve Provenance Across Releases
Store component provenance with release records so historical product versions can be reconstructed even after upstream repositories or package locations change.
Treat Provenance as Supporting Evidence, Not Proof of Security
A well-provenanced component can still contain vulnerabilities. Provenance establishes origin and identity; security assessment, monitoring and remediation remain separate responsibilities.
Official sources
Read the full legal text and Commission material for precise wording, qualifications and updates.