Witness: open-source framework verifies how software was built

TestifySec donated Witness to the CNCF in-toto ecosystem: an open-source CLI that records and signs build attestations and checks them against a policy. It exports SLSA provenance and supports Sigstore, SPIFFE/SPIRE and Archivista storage without elevated privileges.

• Witness records the build command, input materials and outputs in a signed DSSE envelope
• The -a slsa flag exports SLSA provenance, required for SLSA Level 1
• Policies are JSON files with Rego rules and are signed separately
• Supports keyless Sigstore signing, SPIFFE/SPIRE and RFC 3161 timestamps