blechturm

@DesheShai Hi! A provenance question: If I want to ensure that an artifact can be unambiguously traced to the exact code version that produced it, is embedding the codes hash in the artifact metadata sufficient? Or do I need additional cryptography to make this robust?