Supply Chain
Build Provenance
Also: SLSA provenance, attestation
A signed record of where and how an artifact was built, so you can verify it came from the expected source and pipeline.
In more detail
Provenance lets a consumer check that a package was produced by a specific repository and workflow rather than uploaded from a stolen laptop. Registries that support it display the link back to source. It does not prove the source is safe, only that the artifact matches it.