This solves the problem of provenance and possibly build integrity. Given an artifact, it will allow identifying exact source from which each components are bui

This solves the problem of provenance and possibly build integrity. Given an artifact, it will allow identifying exact source from which each components are built. But it still implicitly assumes that the source is secure and trusted. This is where a lot of problem happens when the source is compromised and malicious code is added.