How to use this checklist
This is the gate a pipeline must pass before its artefacts are trusted enough to reach production. It is deliberately about provenance and verification, not about whether the build “looks right”.
A supply chain that fails any item here should be treated as untrusted at deploy time, regardless of how cleanly the build runs. Verification happens in the deploy pipeline, not in a spreadsheet next to the artifacts.
Sign-off
Every critical item must pass. A failing critical item blocks the artefact from being deployed to production; it is not a note for later. Record the date, the reviewer, and the disposition of every item that did not pass.