An organization wants to ensure that production consumes only approved build outputs and can trace their origin. Which controls are appropriate? Select 2 answers.

1. Record and verify supported artifact signatures or provenance at the relevant promotion boundary.
2. Assume a valid signature proves the application has no defects.
3. Make the release bucket publicly writable so teams can fix artifacts quickly.
4. Restrict artifact modification and production publication permissions to the intended release identities.
5. Trust every artifact with the filename approved.zip without checking its content or publisher.