Glossary
Hardware Provenance
Hardware provenance is a verifiable record of a physical component's origin and custody chain — where it was manufactured, who handled it, and what happened to it before it reached final deployment. This is a genuinely distinct concern from software supply-chain trust, which verifies code and build artifacts; a physically substituted or tampered hardware component can undermine every software-level protection running on top of it, since those protections generally assume the underlying hardware itself is exactly what it claims to be.
A device with a compromised component at the hardware level can potentially defeat trust anchors and attestation mechanisms that assume the hardware itself is trustworthy, which is exactly why hardware provenance deserves attention as its own concern, separate from and prior to whatever software-level verification runs afterward — no amount of software-level trust checking can meaningfully vouch for hardware that was already compromised before it ever powered on.