Coming soon — this article is being prepared. Below are its question, intended outcome, and place in the story.
The question
How can you reject an artifact with invalid signature or provenance?
What we will work through
Reject an artifact with invalid signature or provenance.
Before you begin
Previously covered: SBOMs and dependency provenance; Certificates, keys, and trust chains.