Glossary of code provenance terms
Short answer
Code provenance is the record of where code came from: who or what wrote it, which licence applies, and how it reached your project.
The W3C PROV note defines provenance as information about the entities, activities and people involved in producing a thing. For code, that record lives in commit trailers, SPDX licence identifiers, software bills of materials and signed build records. Each term below gives a plain definition and names the document that defines it, listed under Sources.
Most-searched terms
- Vibe coding Writing computer code in a somewhat careless fashion, with AI assistance, in Merriam-Webster's definition. Merriam-Webster
- MCP Model Context Protocol: an open protocol for connecting LLM applications to external data sources and tools. MCP specification
- SPDX A standard list of short licence identifiers, such as MIT, used in file headers like SPDX-License-Identifier: MIT. SPDX specification, Annex E
A to L
AI-assisted code: code in which a tool, rather than the person submitting it, wrote a meaningful part. The Linux kernel's guidelines for tool-generated content apply when a meaningful amount of a contribution was not written by a person in the Signed-off-by chain, and exclude typing aids such as identifier completion, spelling fixes and reformatting.
Assisted-by: a commit trailer naming an AI tool used to prepare a change. The Linux kernel's AI Coding Assistants page asks contributions to carry it, listing specialised analysis tools but not basic tools like git, gcc, make and editors.
Attribution: the credit a licence requires. The Creative Commons BY-SA 4.0 deed asks you to give appropriate credit, provide a link to the licence, and indicate if changes were made.
CC BY-SA: the Creative Commons Attribution-ShareAlike licence. The deed lets anyone share and adapt the material for any purpose, even commercially, provided they give credit and distribute any adaptation under the same licence.
Code referencing: a check that compares an assistant's suggestion with public code. GitHub's documentation says that when an accepted Copilot suggestion matches code in a public repository, the log records the matching file URLs and any licence found.
Co-authored-by: a commit trailer crediting another author. GitHub's documentation gives the format as one Co-authored-by line per co-author with a name and email address.
Content Credentials (C2PA): the C2PA technical specification 2.1 calls Content Credential the preferred non-technical term for a C2PA Manifest, which bundles assertions about a media asset with a digitally signed, tamper-evident claim. It targets media such as images and video rather than source code.
Copyleft: a licence condition that requires anyone who distributes a work to pass on the same freedoms. The GNU GPL version 3, reproduced on the SPDX License List, calls itself a free, copyleft license and says you must pass on to recipients the same freedoms you received.
Detector: a tool that guesses whether text or code was machine-generated. In a 2024 arXiv study, Suh and colleagues found existing AI detection tools all performed poorly on source code.
Developer Certificate of Origin (DCO): a short statement, version 1.1 reproduced in the Linux kernel's guide to submitting patches, that a contributor has the right to submit the work; its first clause covers a contribution created in whole or in part by the signer.
Hallucinated package: a dependency name a code model suggests that does not exist. In a 2024 arXiv study, Spracklen and colleagues found average rates of at least 5.2% for commercial models and 21.7% for open-source models.
M to Z
MCP (Model Context Protocol): the specification describes it as an open protocol for connecting LLM applications to external data sources and tools. An MCP server is a program that exposes tools or data to an assistant through it.
Permissive licence: a licence that allows reuse almost anywhere if the notice is kept. The MIT License, as published by the Open Source Initiative, grants the rights to use, copy, modify, merge, publish, distribute, sublicense and sell, on condition that the copyright and permission notice is included. Permissive is a practitioners' category, not a term in the licence.
Provenance: the W3C PROV-Overview note defines it as information about entities, activities and people involved in producing a piece of data or thing, which can be used to form assessments about its quality, reliability or trustworthiness.
SBOM (software bill of materials): CISA describes an SBOM as a nested inventory, a list of ingredients that make up software components.
Signed commit: a commit carrying a cryptographic signature. The git commit manual describes -S, which GPG-signs a commit with a key that defaults to the committer identity, and separately -s, which adds a Signed-off-by trailer whose meaning depends on the project.
Sigstore: a project for signing and verifying software artifacts such as release files, container images and SBOMs. Its overview says signatures use ephemeral keys and signing events are recorded in a tamper-resistant public log called Rekor.
SLSA: Supply-chain Levels for Software Artifacts, pronounced salsa. The About SLSA page in specification v1.2 calls it a set of incrementally adoptable guidelines for supply chain security; the Build Track currently has Levels 1 through 3, and SLSA does not say whether source code followed secure coding practices.
SPDX License Identifier: a comment such as SPDX-License-Identifier: MIT. Annex E of the SPDX specification says it should sit at or near the top of the file, so the licence information travels with the file.
SPDX snippet tags: SPDX-SnippetBegin and SPDX-SnippetEnd, defined in Annex H of the SPDX specification; licence tags between them apply only to that snippet.
Vibe coding: writing computer code in a somewhat careless fashion, with AI assistance, in Merriam-Webster's definition; the entry credits the term to Andrej Karpathy's post of 2 February 2025.
Watermark: a hidden statistical pattern a generator places in its own output. In a 2023 arXiv paper, Lee and colleagues found existing text watermarks fail on code because code has low entropy, and proposed SWEET, which marks only higher-entropy parts.
How do these terms fit together?
Most terms fall into three groups. Licence terms (SPDX identifiers, snippet tags, attribution, copyleft, permissive licences, CC BY-SA) answer whether you may use the code. Authorship terms (Co-authored-by, Assisted-by, Signed-off-by, AI-assisted code, vibe coding, detectors, watermarks) answer who or what wrote it, and they only work when someone records them at the time. Supply chain terms (SBOM, SLSA, Sigstore, Content Credentials, hallucinated packages) answer what software was built from and whether it changed.
A signature records who approved a change; only a statement made at the time records who or what wrote it.
How we checked
Checked on 2026-10-15 by the CodeLifter editors: every definition was compared with the document listed for it under Sources, and only what those documents state is used. Permissive licence is labelled as a practitioners' category because the MIT text does not use the word. Drafted with AI assistance; every claim checked against its source.
Questions and answers
What is code provenance?
The record of where code came from: who or what wrote it, its licence, what it was built from and whether it changed. The W3C PROV note defines provenance as information about the entities, activities and people involved in producing something.
Is vibe coding a formal term?
No. Merriam-Webster lists it as a slang entry, notes it is very recent and may change meaning, and credits it to a post of 2 February 2025.
Is Signed-off-by the same as a signed commit?
No. Signed-off-by is a text trailer whose meaning depends on the project, often certifying the DCO; a signed commit carries a cryptographic signature made with git commit -S.
What is the difference between an SBOM and SLSA?
An SBOM lists what software contains; SLSA is a set of guidelines for securing how software is built. SLSA's About page compares itself to the food safety rules that make an ingredient list credible.
Do C2PA Content Credentials work for source code?
Not in practice. The C2PA specification targets media assets such as images and video; for code, provenance is recorded with commit trailers, signed commits, SPDX tags and SBOMs.
Something missing?
Suggest a term on the forum with a link to the document that defines it, and the editors will add it after checking that document.
Sources
An editor checked every claim on this page against these sources on 2026-10-15. If a source has changed since, the source is the authority.
