{"id":18249,"plugin_id":"plugins_6a86f0bc955881919122c7c2d87da0d9","kind":"skill","collection_source":null,"comparison_source":null,"observed_at":"2026-09-30T23:14:45.441Z","digest":"b97e28c0ad3538b93bd66edc27cd82904f6662b2895e17ff22f87dfd7314425f","against":null,"payload":{"description":"Use when software provenance, SBOM, dependency origin, licenses, signatures, or build attestations matter.","included_files":[],"name":"auditer-provenance-logicielle","skill_md_contents":"---\r\nname: auditer-provenance-logicielle\r\ndescription: Use when software provenance, SBOM, dependency origin, licenses, signatures, or build attestations matter.\r\n---\r\n# Auditer provenance logicielle\r\n\r\n## Fonction\r\nÉtablir d’où vient réellement un artefact logiciel et de quoi il dépend.\r\n\r\n## Procédure\r\n1. Inventorier source, dépendances directes/transitives, versions et artefacts.\r\n2. Qualifier licences, provenance, verrous, signatures ou attestations lorsqu’elles existent.\r\n3. Repérer dépendances opaques, scripts de build et sources non vérifiées.\r\n\r\n## Preuve\r\nLa provenance est suffisamment traçable pour soutenir les affirmations de source, version et composition.\r\n"},"changes":[],"summary":"First saved snapshot. No earlier version is available for comparison.","summary_kind":"deterministic","summary_metadata":{}}