Witness Tool Moves to Cloud Native Computing Foundation
The open-source supply chain utility provides automated build verification to help secure CI/CD pipelines.
Updated on Oct. 26, 2026 in Software
Live Poll
Do you trust open-source tools to effectively secure the software supply chain?
TestifySec has donated its open-source supply chain security tool, Witness, to the Cloud Native Computing Foundation. The software automates build process recording and signature verification to ensure code integrity before deployment.
Why it matters
As software supply chain attacks increase, automated verification tools like Witness help organizations track build provenance. By moving to a foundation-governed model, the project aims to standardize how teams audit build pipelines against security policies.
Witness enables SLSA level 1 provenance export and uses the DSSE (Dead Simple Signing Envelope) format for attestations. Verification relies on RFC 3161-compliant timestamps and integrates keyless signing through Sigstore and SPIFFE/SPIRE.
The players
TestifySec
The cybersecurity firm that developed Witness to address software supply chain integrity.
Cloud Native Computing Foundation
The open-source foundation that maintains a ecosystem of cloud-native infrastructure projects.
The details
Witness operates by wrapping standard build commands to generate cryptographically signed JSON files containing metadata about the build process. To verify an artifact, a system checks the signed policy against the build record and the corresponding public key. This process confirms which machine built the software, the source materials used, and whether the digital signatures remain valid prior to deployment.
Timeline
October 26, 2026: Witness availability is confirmed via publication.
The Tech Race
Witness joins a crowded field of open-source security tools aiming to automate build integrity across cloud environments. By integrating with Sigstore and SPIRE, the tool aligns with the industry-wide push for standardized, non-manual supply chain provenance.
Development teams using GitHub, GitLab, AWS, or GCP can now integrate Witness to automate their build verification pipelines. It requires configuring existing build workflows to support DSSE-formatted attestations and keyless signing.
The takeaway
Witness provides a path toward automated supply chain auditing, reducing the reliance on manual checks during CI/CD processes. Interested teams should monitor the Cloud Native Computing Foundation project repository for updates on higher SLSA tier support.
Further reading
For more on evolving security standards, explore the latest developments in Software.
Live Poll
Do you trust open-source tools to effectively secure the software supply chain?
