Correct Answer: Immutable image artifacts with SHA-based tags and signed build provenance manifests
Explanation: Immutable images identified by cryptographic digests (SHA) guarantee that the binary deployed is identical to the binary produced by the build. When paired with signed provenance manifests that include build inputs (source commit hash, dependency versions, build environment, artifact checksums, and signer identity), you obtain cryptographic traceability and non-repudiation. This lets operators and auditors verify exactly which source and dependencies produced the runtime artifact, reproduce the build, and validate authenticity at deploy time. It also enables secure rollbacks to the exact prior artifact and supports supply-chain security practices (e.g., sigstore/rekor-style attestations). In short: immutable, signed artifacts + provenance = reproducible, auditable, and secure deployments.
Correct Answer: Immutable image artifacts with SHA-based tags and signed build provenance manifests
Explanation: Immutable images identified by cryptographic digests (SHA) guarantee that the binary deployed is identical to the binary produced by the build. When paired with signed provenance manifests that include build inputs (source commit hash, dependency versions, build environment, artifact checksums, and signer identity), you obtain cryptographic traceability and non-repudiation. This lets operators and auditors verify exactly which source and dependencies produced the runtime artifact, reproduce the build, and validate authenticity at deploy time. It also enables secure rollbacks to the exact prior artifact and supports supply-chain security practices (e.g., sigstore/rekor-style attestations). In short: immutable, signed artifacts + provenance = reproducible, auditable, and secure deployments.