Verifiable origin: where a component came from and how it was built.
Provenance answers "where did this artifact actually come from?" — which source repository, which commit, which build system, signed by whom. Without it, a package on a registry is just a claim. SLSA (Supply-chain Levels for Software Artifacts) is the industry framework that grades how tamper-resistant that build story is.
Gold components carry end-to-end origin tracking with automatically generated SBOMs and SLSA attestations, meeting the requirements of US federal guidance like EO 14028.