Witness – software supply chain attestation framework

Witness is a framework for generating and verifying software supply chain attestations. It records evidence about the operations used to build, test and distribute software, helping organisations establish an auditable record of how an artifact was produced. The application uses the in-toto attestation specification to describe activities throughout the software development lifecycle.

Witness integrates into build pipelines and other automated environments, capturing information about commands, inputs, outputs and the systems responsible for executing individual steps. The resulting attestations can be cryptographically signed and subsequently checked against policies defining acceptable build processes. Its embedded Open Policy Agent (OPA) Rego engine allows administrators to enforce requirements beyond simple signature validation, such as ensuring that particular operations were performed by authorised identities. The framework originated at TestifySec and became part of the CNCF in-toto ecosystem.

This is free and open source software.

Key Features

• Generate signed attestations describing software build and release operations.
• Record materials consumed and products generated during pipeline execution.
• Pluggable attestors for collecting evidence from different environments.
• Integrations with GitHub, GitLab, AWS and Google Cloud.
• Verify attestation collections against signed policy documents.
• Embedded OPA Rego policy engine for evaluating supply chain requirements.
• Validate trusted signing identities using public keys and X.509 certificates.
• Keyless signing through Sigstore and SPIFFE/SPIRE integration.
• Support RFC 3161 timestamp authorities.
• Check relationships between artifacts produced by different pipeline steps.
• Detect missing attestations and policy violations.
• Operate in containerised and non-containerised environments without elevated privileges.
• Experimental process tracing and process tampering prevention.
• Store attestations using Archivista.
• Distribute attestations and policies across air-gapped environments.
• Cross-platform support – runs on Linux, macOS, and FreeBSD.

Website: github.com/in-toto/witness
Support:
Developer: in-toto community
License: Apache License 2.0

Witness is written in Go. Learn Go with our recommended free books and free tutorials.

LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software. We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README.