Witness: Open-source framework for verifying how your software was built
Witness is an open-source command-line tool that records how software gets built, signs that record, and checks it against a policy before the software ships. TestifySec built Witness and donated it to the in-toto ecosystem within the Cloud Native Computing Foundation, and an open community now maintains it.
A compiled binary doesn’t say which machine built it or what code went in. Witness lets a team check which command produced the file, which materials went into it, and whether a trusted key signed each step. When a check fails, witness verify exits with a non-zero status and states the reason, which gives a CI job something concrete to stop on.
What a run records
Witness wraps the build command itself. In the project’s getting-started tutorial, witness run --step build runs go build and writes a JSON file of attestations: signed statements about the materials that went in, the command that ran, and the products that came out. The file is a DSSE envelope, a standard wrapper for signed data, and you can decode it with jq and base64 to read it. Adding -a slsa exports SLSA provenance, which the tutorial lists as a mandatory requirement for SLSA Level 1, the entry tier of a graded build-integrity framework.
Who controls the gate
The policy is a JSON file that names each step, the attestation types that step must carry, and the public keys allowed to sign it. Custom rules go in as base64-encoded Rego, the language of the Open Policy Agent, and Witness requires every attestation in a step to pass. Then the policy itself gets signed.
The tutorial signs the policy with the same testkey.pem that signed the build. That works for a demo, and in production it would let one stolen file write both the evidence and the rules that judge it.
Beyond the demo
Witness integrates with GitHub, GitLab, AWS, and GCP, and it runs in containers or on hosts without elevated privileges. It supports keyless signing through Sigstore and SPIFFE/SPIRE, timestamps from RFC 3161 authorities, and storage in Archivista, a companion in-toto project for attestations. Process tracing is still marked experimental. Verification works across an air gap, provided the verifier holds the signed policy, the artifact, and the matching public key.
Witness is available for free on GitHub.
Must read:
- 20 open-source cybersecurity tools to keep your team ready for anything
- GitHub CISO on security strategy and collaborating with the open-source community
Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!
