NIST SP 1326 and Component Provenance: Source, Binary, and the Gap Between Them

NIST Special Publication 1326, finalized July 8, 2026, puts component provenance at the center of software supply-chain security guidance. "Provenance" sounds abstract until you try to answer a simple question: where did this component come from, and can I prove it hasn't been tampered with? For many development teams, that question exposes an uncomfortable split - some components you have source code for, and some you don't.

This article breaks down what provenance means under SP 1326, how SBOMs fit in, and why the source-vs-binary distinction is the practical decision point for tooling.

What Provenance Actually Means

Provenance, in the supply-chain context, has two dimensions:

Origin - Can you trace a component back to a known, authoritative source? Who published it, from what repository, at what version, under what license?

Integrity - Can you verify that the artifact you're running matches what the author released? Cryptographic hashes, signatures, and attestation chains answer this.

SP 1326 asks suppliers to address both. An SBOM that just lists component names is a start, but it isn't provenance. Provenance requires evidence: where a component came from and a mechanism to detect if it was altered in transit or at rest.

Where SBOMs Fit In

An SBOM (Software Bill of Materials) is the structured inventory that makes provenance tractable. Two formats dominate in practice:

Neither format certifies compliance with anything. An SBOM is a document; provenance is the evidence that makes the document trustworthy. SP 1326 guidance points toward SBOMs as a foundational artifact, but the integrity layer - hashes, signing, attestation - is what turns an inventory list into actual provenance.

When you generate an SBOM, you want it to include component identifiers (CPE, PURL), version pinning, declared licenses, known vulnerability references, and, ideally, cryptographic hashes of the artifacts themselves. Relationships between components - what depends on what - matter too, especially for transitive dependencies.

Source-Based Provenance: When You Have the Code

If your team controls the source code of a component, or if you're consuming an open-source library you can inspect, you're in source-based provenance territory.

Here you can:

Labrador is built for exactly this situation. It combines SAST, SCA, and SBOM generation in one pipeline, designed for teams that need to get from "we have source" to "we have a defensible, accurate bill of materials" without adding a lot of manual steps or headcount. The SBOM output supports tracing component origin through the build, which is the core provenance ask when source is available.

The challenge with source-based provenance is completeness. Development teams often undercount their transitive dependencies - the dependencies of dependencies. SP 1326's guidance on provenance implicitly covers the whole graph, not just your direct imports.

Binary-Based Provenance: When You Don't Have the Code

This is where most organizations hit a wall.

Consider a firmware image from a hardware supplier, a closed-source commercial library shipped as a compiled object, or a third-party SDK provided only as a binary. You have no source to analyze. You can't run SAST on it. You can't regenerate a dependency graph from a manifest. But SP 1326 still expects you to address the provenance question for that component.

Binary-based provenance means extracting what you can from the artifact itself:

This is a meaningfully harder problem than source-based provenance, and it requires different tooling.

KhaiCode addresses the binary case. It's a binary-first supply-chain security product that performs binary composition analysis and generates SBOMs without requiring source code. If you're working with closed-source third-party components, firmware from a hardware partner, or any artifact where source is simply not available, KhaiCode fills the gap that source-centric tools like Labrador are not designed to cover.

The distinction matters when you're inventorying your full product - not just the code your team wrote, but everything that ships in the package.

The Practical Split: One Product Rarely Covers Both

A common mistake is assuming a single SBOM tool handles the entire provenance picture. Source-based tools do source well. Binary-analysis tools do binaries. The line between them isn't a capability gap to paper over - it reflects a fundamental difference in what information is available.

For a software product that combines internally developed code, open-source dependencies, and closed-source or firmware components (common in embedded systems, medical devices, and enterprise software with OEM libraries), a complete provenance story requires both approaches:

The SBOM artifacts from both can be composed into a unified bill of materials for the product as a whole, which is what SP 1326 guidance is pushing toward.

A Note on Compliance Claims

No tool makes you compliant with SP 1326. The publication is guidance, not a certification framework, and "compliant" isn't a status it confers. What tooling does is help you produce the evidence - SBOMs, provenance records, integrity attestations - that demonstrates your supply-chain practices. The argument for compliance is built from that evidence; the tool is just what makes the evidence tractable to produce.

Next in This Series

This article is part of Apona's ongoing coverage of NIST SP 1326. Subsequent pieces in the series cover vulnerability disclosure and patch cadence requirements, SBOM format selection criteria, and how SP 1326 intersects with existing frameworks like SSDF and EO 14028.

If you're working through what SP 1326 means for your software supply chain and want to talk through where Labrador fits, start at apona.ai/labrador.

This post is about Labrador.

More on this