Downstream integrity is the trust that later systems place in software artifacts created earlier in the delivery chain, such as compiled binaries, packages, container images, or update bundles. In a healthy pipeline, each stage assumes the previous stage produced a legitimate artifact and preserved its contents without unauthorized change.
This matters because a compromise in a build server, source repository, or release pipeline can corrupt that trust. If an attacker alters build steps, injects code, steals signing keys, or replaces artifacts before they are published, downstream systems may deploy malicious software while treating it as authentic. Defenders protect downstream integrity with strong access control, artifact signing, provenance records, isolated build environments, reproducible builds, and verification at install or deployment time. The goal is to ensure that every consumer can check where an artifact came from and whether it changed after it was built.