Secure supply chain and continuous delivery
Know which software, models and data are in your release.
Reviewed: 2026-10-03
Source-based teaching example · Fictional data
Narration: Microsoft Mark · locally synthesized

00:00:00.000 — What you will learn

Know which software, models and data are in your release.

Visual description:
Know which software, models and data are in your release.

00:00:06.792 — The idea

Inventory the parts loaded at runtime and their origins. Check exact versions and bytes. Matching a hash proves identity, not that the item is trustworthy or suitable.

Visual description:
Inventory the parts loaded at runtime and their origins. Check exact versions and bytes. Matching a hash proves identity, not that the item is trustworthy or suitable.

00:00:21.000 — One useful term

Hash. A fingerprint of file contents used to check whether the bytes match.

Visual description:
A fingerprint of file contents used to check whether the bytes match.

00:00:29.042 — A worked example

The supplied release record contains a changed model hash and a flagged training dependency. The pipeline blocks release, records why, and checks the corrected bundle.

Visual description:
The supplied release record contains a changed model hash and a flagged training dependency. The pipeline blocks release, records why, and checks the corrected bundle.

00:00:42.417 — Your turn to think

Does a matching file hash prove the file’s source is safe? Pause and decide before continuing.

Visual description:
Does a matching file hash prove the file’s source is safe?
Pause the video if you need more time.

00:00:59.583 — Why this answer works

No. Verify origin and relevant security evidence separately. Keep unknown-origin items out of use pending review.

Visual description:
No. Verify origin and relevant security evidence separately. Keep unknown-origin items out of use pending review.

00:01:10.708 — Check 1

Inventory every runtime-loaded part.

Visual description:
Inventory every runtime-loaded part.

00:01:16.083 — Check 2

Check both byte identity and origin.

Visual description:
Check both byte identity and origin.

00:01:21.375 — Check 3

Keep release evidence reproducible.

Visual description:
Keep release evidence reproducible.

00:01:26.542 — Now try a different case

Open the lesson and try its different practice case. Use every check in the full task. Watching alone does not mark the lesson complete.

Visual description:
Open the lesson
Try the new case
Check and revise
The full task and its requirements are in the linked lesson.