Provenance provides verifiable information about how an artifact was produced, including the build that created it and the related build metadata. By retrieving this provenance, you can validate that the artifact comes from the expected Lightwell build and that it has not been modified.

Verifying the provenance establishes the authenticity and integrity of the artifacts to which they refer. Provenance verification in Lightwell is ecosystem-specific. Java artifacts and Python wheel artifacts use different signing keys and methods to retrieve provenance data. You must use the correct key and retrieval method for the ecosystem of the artifact that you want to verify.

The following signing keys are available:

• PNC Provenance Signing Key 1: Verifies provenance for PNC-generated Java artifacts only.
• Red Hat RELEASE3: Verifies Python wheel provenance generated by the Lightwell Python release workflow.