1. A method comprising: generating a value from an ordered set of attribute values that have been collated, the ordered set of attribute values identifying a set of source components from which a particular software deployment is run; generating for the particular software deployment, a first signature by applying a hash function to the value; storing, in at least one of volatile or non-volatile storage, mapping data that maps the first signature to the value; generating a second signature based on information that defines target source components for a set of software deployments that includes the particular software deployment, the second signature associated with a particular version of a gold image including the target source components, wherein one or more other signatures are associated with one or more other respective versions of the gold image; comparing the first signature with the second signature and the one or more other signatures to determine which version of the gold image the particular software deployment is currently following, if any; determining whether the set of source components satisfy the target source components by comparing the first signature with the second signature; in response to determining that the set of source components do not satisfy the target source components based on a comparison of the first signature and the second signature, performing a set of one or more operations to update the particular software deployment.