Witness Tool Enhances Software Supply Chain Security with Open-Source Build Verification
TestifySec donates Witness, an open-source tool for recording and verifying software build processes, to the in-toto ecosystem to bolster supply chain integrity.
A new open-source command-line tool named Witness has been introduced to enhance the security and transparency of the software supply chain. Developed by TestifySec and now maintained by an open community within the Cloud Native Computing Foundation's in-toto ecosystem, Witness aims to provide verifiable assurance about how software is built.
The core functionality of Witness lies in its ability to record and sign the build process. Traditionally, a compiled binary offers little information about its origin, such as the specific machine used for compilation or the exact source code incorporated. Witness addresses this by wrapping build commands, generating signed attestations that detail the materials used, the commands executed, and the resulting artifacts. This detailed record allows development teams to rigorously check that binaries originate from trusted sources and contain only the intended code.
When a build process is executed with Witness, it generates a JSON file containing these attestations. This file is structured as a DSSE (Discovery Service for Secure Enclaves) envelope, a standard format for signed data. For those adhering to the SLSA (Supply chain Levels for Software Artifacts) framework, Witness can export SLSA provenance, a crucial component for achieving SLSA Level 1, the foundational tier of this build-integrity framework.
Beyond merely recording the build, Witness incorporates a policy-driven verification mechanism. A policy file, itself signed by trusted keys, defines the expected steps in the build process, the types of attestations required for each step, and the public keys authorized to sign these attestations. Custom verification rules can be implemented using Rego, the policy language of Open Policy Agent. Witness ensures that every attestation within a build step meets the defined policy requirements before the software is cleared for release.
While the initial setup might involve signing the policy with the same key used for the build in demonstration scenarios, production environments necessitate a more robust key management strategy to prevent a single compromised key from undermining both the evidence and the verification rules. This highlights the importance of secure key handling in maintaining the integrity of the entire process.
Witness offers broad integration capabilities, supporting platforms like GitHub, GitLab, AWS, and GCP. It can run in containerized environments or directly on hosts without requiring elevated privileges. Further enhancing its utility, Witness supports keyless signing through Sigstore, secure identity management via SPIFFE/SPIRE, timestamps from RFC 3161 authorities, and artifact storage in Archivista, a companion in-toto project. While process tracing is still experimental, the verification process can function even in air-gapped environments, provided the verifier has access to the signed policy, the artifact, and the corresponding public key.
The availability of Witness as a free, open-source tool on GitHub democratizes access to advanced software supply chain security measures. By providing a transparent and verifiable method for inspecting build processes, Witness empowers organizations to build greater trust in their software artifacts and mitigate risks associated with compromised development pipelines.