As cited
Copy frozen at (site build).
vulnerabilities
Witness: Open-source framework for verifying how your software was built
Witness is an open-source command-line tool that records, signs, and verifies how software is built by checking the build process against a defined policy. TestifySec created the tool and donated it to the in-toto ecosystem under the Cloud Native Computing Foundation, where it is now community-maintained. The tool helps teams verify which commands produced built artifacts and which materials and inputs were used in the build process.
Why it matters: Development and security teams can use Witness to establish supply chain integrity controls and detect unauthorized or unexpected build modifications before deployment.
- Source published
- First seen by Cybersecurity Tracker