# Witness framework enables software supply chain attestation and policy enforcement

> **Key takeaway:** Witness provides a framework for recording and verifying software build evidence using in-toto specifications and OPA Rego policies.

**Published:** 2026-11-12T21:34:47+00:00 
**Source:** LinuxLinks 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/witness-framework-enables-software-supply-chain-attestation-.html 

## Summary
Witness is an open-source framework designed to secure the software supply chain by generating and verifying attestations. It captures detailed evidence regarding the commands, inputs, outputs, and systems used during the build, test, and distribution phases of the software development lifecycle.

By integrating into automated build pipelines, the tool allows organizations to create an auditable record of artifact production. It utilizes the in-toto attestation specification and features an embedded Open Policy Agent (OPA) engine to enforce complex security requirements through Rego policies.

## Technical architecture and security features
- **Attestation Standards:** Uses the in-toto specification to describe lifecycle activities and supports Sigstore for keyless signing alongside SPIFFE/SPIRE integration.
- **Policy Enforcement:** Includes an embedded OPA Rego engine, enabling administrators to validate build processes against specific requirements rather than just checking digital signatures.
- **Evidence Collection:** Features pluggable attestors to gather data from various environments, including integrations for GitHub, GitLab, AWS, and Google Cloud.
- **Verification Capabilities:** Supports RFC 3161 timestamp authorities and can detect missing attestations or policy violations across different pipeline steps.
- **Deployment Flexibility:** Operates on Linux, macOS, and FreeBSD in both containerized and non-containerized environments without requiring elevated privileges.

## Why it matters
As part of the CNCF in-toto ecosystem, Witness provides critical tooling for Linux distributions and software maintainers to defend against supply chain attacks. It allows developers to mathematically prove that a distributed binary was produced via an authorized and untampered process.