Witness is a pluggable framework that automates, normalizes, and verifies software artifact provenance to secure the software supply chain.
Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.
Witness is used by security teams and DevOps engineers to create and verify audit trails for software throughout the entire software development lifecycle, ensuring compliance and detecting tampering. It integrates into CI/CD pipelines and infrastructure to enforce supply chain security policies and validate that software was produced and handled securely.
Witness is designed to run without elevated privileges, enhancing security in diverse environments. It supports keyless signing and integrates with multiple cloud providers, making it flexible for modern DevOps workflows. Users should leverage the embedded OPA Rego policy engine to tailor supply chain policies to their organizational requirements. Experimental features like process tampering prevention should be used with caution.
Download the Witness binary from the releases page
Or run the install script: bash <(curl -s https://raw.githubusercontent.com/in-toto/witness/main/install-witness.sh)
For manual installation and integrity verification, follow instructions in INSTALL.mdbash <(curl -s https://raw.githubusercontent.com/in-toto/witness/main/install-witness.sh)
Installs the latest release of Witness using the official install script