Provenance statement doc that binds source, workflow, dependencies, and signatures to the exact signed package digest.
Provenance statement doc that binds source, workflow, dependencies, and signatures to the exact signed package digest.