Update provenance is proof that a software update really came from a trusted, authorized source. In practice, this means the update can be traced to the legitimate vendor or build pipeline, usually through cryptographic signatures, certificate checks, and a verified delivery channel.
It matters because attackers often try to abuse update mechanisms instead of breaking software directly. If a device accepts a forged or tampered update, malware can be installed with the same trust users give to routine maintenance. That is especially important for embedded and mobile systems, where over-the-air updates are normal and difficult to inspect manually. Defenders protect update provenance by signing packages, validating signatures before installation, locking down who can publish updates, and monitoring for unusual installer behavior. In attacks, compromised update paths can turn a trusted device into malware infrastructure; in defense, strong provenance is one of the main barriers that keeps that from happening.