Witness records and checks how software was built before release
Original title: Witness: Open-source framework for verifying how your software was built
TestifySec donated the CLI to CNCF’s in-toto project; it signs build attestations and fails CI when policy checks do not pass.
Witness is an open-source command-line tool that wraps a build command, records materials, the command, and outputs as signed attestations, and verifies them against a signed policy. A failed check makes witness verify exit non-zero with a reason, so a CI job can stop the release. It can export SLSA provenance and supports Sigstore, SPIFFE/SPIRE, RFC 3161 timestamps, and Archivista. The article warns that signing the policy and the build with the same key is only safe for a demo.
- TestifySec donated Witness to the in-toto ecosystem inside the CNCF.
- Adding -a slsa exports SLSA provenance listed as required for SLSA Level 1.
- Policies name steps, required attestation types, and allowed signing keys.
- Custom rules are base64-encoded Rego, and every attestation in a step must pass.
- Process tracing is experimental; air-gapped verification needs the policy, artifact, and key.
- Vendors
- TestifySec
- Products
- Witness
- Organizations
- Cloud Native Computing Foundation
From the original article
2 min read at helpnetsecurity.com
Witness is an open-source command-line tool that records how software gets built, signs that record, and checks it against a policy before the software ships. TestifySec built Witness and donated it to the in-toto ecosystem within the Cloud Native Computing Foundation, and an open community now maintains it. A compiled binary doesn’t say which machine built it or what code went in.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.