Binary provenance is the process of verifying where a compiled program came from, how it was built, and whether it has been modified after release. In practice, it combines source control, build records, package signatures, hashes, and deployment records to answer a simple question: is this executable the one we trust?
This matters because attackers often target binaries instead of code. They may replace a legitimate program with a trojanized copy, inject malicious code during build, or alter an installed file on a server. In a proxy or load-balancer environment, a tampered binary can quietly inspect, rewrite, or filter traffic while still appearing normal. Defenders use binary provenance to detect these changes with integrity monitoring, signed packages, reproducible builds, and comparison against known-good artifacts. Strong provenance helps separate a real vendor binary from a compromised or repackaged one.