Learn English vocabulary for build provenance and supply chain integrity: attestation, SLSA provenance predicates, in-toto, hermetic builds, and reproducible builds.
0 / 14 completed
1 / 14
'Build provenance' in software supply chain security means:
Provenance answers 'where did this artifact come from and how was it built?' A signed provenance document lets consumers verify that a binary was built from a specific git commit by a trusted CI system — not tampered with after the fact.
2 / 14
In the SLSA framework, a 'provenance predicate' is:
SLSA provenance follows the in-toto Attestation Framework. The 'predicate' is the content: it records the builder's identity, the source repository, the commit SHA, build parameters, and build start/finish times — all signed by the build platform.
3 / 14
A 'hermetic build' is one that:
Hermetic builds declare all inputs before starting, then cut off network access. This prevents a supply chain attack where a build script fetches a malicious dependency at build time. Google's Bazel supports hermetic builds; they are a requirement for SLSA Build Level 3.
4 / 14
'Reproducible builds' means that:
Reproducible (deterministic) builds let anyone verify an artifact by rebuilding from source and comparing hashes. If a binary you downloaded matches the binary built from published source, you have strong evidence it was not backdoored. Debian and Tor project are leaders in this space.
5 / 14
The 'in-toto' framework provides supply chain security by:
In-toto captures the full supply chain: each step (checkout, test, build, sign) produces a signed link file listing inputs and outputs. The 'layout' file defines allowed steps and signers. A consumer validates the chain before trusting the artifact — used by PyPI, Sigstore, and SLSA.
6 / 14
Sarah from the security team just left a comment on your PR describing a potential vulnerability. She's using the term 'tamper evidence'. What does she likely mean in this context?
'Tamper evidence' refers to the ability to detect if a piece of software has been altered since its original creation. This is crucial in supply chain security because it allows you to verify that the code hasn't been compromised during build or deployment. Options A, C, and D are unrelated to the concept of verifiable integrity.
7 / 14
Ben sent a Slack message: 'I'm adding a checksum to the Docker image build. This should provide tamper evidence.' Which best describes Ben's approach?
A checksum, like SHA-256, generates a fixed-size value based on the data it's applied to. Any modification to the Docker image will result in a different checksum, providing a simple and effective method for detecting tampering. While digital signatures (Option B) are more complex, a checksum is a foundational technique.
8 / 14
You're writing the description for a Pull Request to update your project's CI/CD pipeline. You want to emphasize provenance. Which of the following statements is MOST accurate?
This option most directly addresses provenance by highlighting the comprehensive security controls across the entire lifecycle. While the other options touch upon related aspects (hashes in Option C, vulnerability testing in Option D), they don't explicitly focus on the ability to track and verify the origin of software components – a core principle of provenance.
9 / 14
You are reviewing a Dockerfile for a new microservice. The developer has included instructions to 'sign each layer with a GPG key.' What is the likely purpose of this action?
GPG (GNU Privacy Guard) signatures create a digital fingerprint of the Docker layers. Any change to a layer will invalidate the signature, instantly revealing tampering. This provides strong evidence that the image hasn't been compromised and ensures it originates from a trusted source.
10 / 14
David from DevOps is explaining the importance of provenance to the team during a standup. He says, 'We need to track *how* our code got here, so we can quickly identify any changes that might have introduced problems.' Which of the following best captures David's message?
David is emphasizing *lineage*, which is a core component of provenance. Tracking the history of changes – from commit to deployment – allows developers to quickly understand how a system evolved and pinpoint the source of issues if something goes wrong. The misconception here is that provenance solely relates to security; it's about full visibility into the entire development lifecycle.
11 / 14
Emily left a comment on your PR stating: 'This image build lacks sufficient tamper evidence. Consider adding a cryptographic signature to verify its integrity.' What is Emily primarily concerned about?
Emily's comment highlights concerns about *integrity*. A cryptographic signature provides a verifiable proof that the image hasn't been altered since it was built. Without this 'tamper evidence', an attacker could potentially modify the image and introduce malicious code. This is crucial for supply chain security.
12 / 14
You're drafting a Pull Request description for a new feature that incorporates SLSA practices. Which statement best explains the role of 'build provenance' in your project?
The key here is understanding that 'build provenance' isn't just about efficiency; it's about accountability. It provides a traceable record of each build step, allowing you to verify the integrity and authenticity of your software. While security is a major benefit, the core concept extends beyond just vulnerability detection.
13 / 14
Mark in the code review comments on a new service's Dockerfile: 'I noticed you're using layers. While layering is efficient, it doesn't inherently provide tamper evidence. Consider signing each layer with a GPG key.' What technical benefit does Mark suggest?
Mark is pointing out that layering alone doesn't guarantee integrity. By signing each layer with a GPG key, you create a cryptographic chain— any alteration to a single layer will invalidate the signature of all subsequent layers, providing strong tamper evidence and allowing for verification of the build process.
14 / 14
You receive an API response from your CI/CD system indicating a 'build failure' with the following details: 'Inconsistent checksums detected in layer 3.' What is this likely referring to?
The 'inconsistent checksums' message is a clear indicator of tampering. Checksums are cryptographic hashes used to verify data integrity. If they differ, it means that the contents of layer 3 have been altered since the original checksum was calculated, confirming a potential security breach or an error in the build process.
What will I learn from the "Build Provenance Vocabulary" exercise?
Learn English vocabulary for build provenance and supply chain integrity: attestation, SLSA provenance predicates, in-toto, hermetic builds, and reproducible builds.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall required.
How many questions are in this exercise?
This set contains 14 multiple-choice questions, each with a detailed explanation shown after you answer.
Do I need to create an account to track my progress?
No account is required. Your progress bar and score reset each time you reload the page, but you can retry the exercise as many times as you like.
Who is this Supply Chain Security exercise for?
This exercise is built for IT professionals and non-native English speakers who need to read, write, and discuss supply chain security topics confidently at work.
What happens if I answer a question incorrectly?
You will see the correct answer highlighted along with a detailed explanation of why it is correct -- so every wrong answer becomes a learning moment, not just a lost point.
Can I retry this exercise?
Yes -- click "Try again" on the results screen at any time to reset your score and go through all the questions again.
How long does this exercise take to complete?
Most learners finish all 14 questions in under 10 minutes, since each question is answered by clicking a single option.
Where can I find more Supply Chain Security exercises?
See the full Supply Chain Security exercises hub for more vocabulary drills on this topic.
Is this exercise mobile-friendly?
Yes -- the exercise works on any device with a modern browser, including phones and tablets, with no app download required.