NIST SP 800-204D Software Supply Chain Security in DevSecOps CI/CD Pipelines 5.1.1b: Produce environment, process, materials and artifact attestations for each build

What does 5.1.1b require?

Each build produces four attestations: an environment attestation (an inventory of the build environment and its configuration), a process attestation (the programs and steps that ran, populated on a best-effort basis because observing tools cannot always separate process from materials data), a materials attestation (the raw data and inputs consumed) and an artifact attestation (the outputs produced). The evidence is generated concurrently with the build by a process that is more trusted, or better isolated, than the build it observes, so that a compromised build cannot tamper with its own evidence.