# A successful delivery is more than a green pipeline.

Adrien Murillo — Murillo Consulting

Connect source code, artifacts and what actually runs: a practical approach to a verifiable software supply chain.

## Start with a verifiable question

Which source produced this artifact, and which checks did it pass? Answering requires connecting information often scattered across the repository, CI, registry and platform. A scan result without an artifact identifier cannot explain what was delivered. A useful starting point is a path the team can replay for one precise version.

## Give evidence a clear purpose

NIST SSDF describes security practices to integrate into a development lifecycle. SLSA specifies increasing supply-chain guarantees, including provenance. These references address complementary questions: how to organize practices, and how to attest where an artifact came from. Neither replaces knowledge of the system or the decisions of the operating team.

## Build a readable chain

Connecting the commit, image digest, SBOM, check results and admission decision makes investigation more precise. Every control needs an owner and a defined response to failure. Exceptions deserve the same attention: reason, scope, review date and owner. Otherwise, a temporary bypass can quietly become normal practice.

## Plan what comes next

A deployment may pass all checks and still fail operationally. Verification must include meaningful signals, rollback procedures and retained traces. Kube Aegis Forge illustrates these connections in a public demonstrator. It is a basis for reading and local verification, not a compliance attestation for a client platform.

## Sources
- [NIST — Secure Software Development Framework](https://csrc.nist.gov/pubs/sp/800/218/final)
- [SLSA — Specification v1.2](https://slsa.dev/spec/v1.2/)

## Navigation
- [Independent engineer and trainer.](/en/profil)
- [Engineering services.](/en/services)
- [Selected work.](/en/realisations)
- [Open-source projects.](/en/projets)
- [Guides to put into practice.](/en/ressources)
- [Let’s discuss your project.](/en/contact)
- [From scope to handover.](/en/approche)
- [Real contexts. Real constraints.](/en/secteurs)
- [Learn by making decisions.](/en/lab)
- [Legal notice](/en/mentions-legales)
- [Privacy](/en/confidentialite)
- [Train your teams. Through practice.](/en/formation)

[Contact](mailto:contact@adrien-murillo.com)