Witness is an open-source command-line tool that records how software gets built, signs that record, and checks it against a policy before the software ships. TestifySec built Witness and donated it to the in-toto ecosystem within the Cloud Native Computing Foundation, and an open community now maintains it. A compiled binary doesn’t say which machine built it or what code went in.
Witness: Open-source framework for verifying how your software was built
About this summary. This is a short excerpt from the description that Help Net Security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.helpnetsecurity.com/2026/10/26/witness-open-source-software-supply-chain-tool/
Source attribution: headline and facts are from Help Net Security (helpnetsecurity.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Meshery: Open-source cloud-native manager for Kubernetes
Meshery is an open-source tool for designing, deploying and managing Kubernetes infrastructure, built by Layer5 and its community and hosted as a Cloud Native Computing…
Using Parseable with Datasette for OpenTelemetry traces
TIL: Using Parseable with Datasette for OpenTelemetry traces I saw Parseable in a Show HN today - it's a new observability platform with both an open source (AGPL) Rust…
Keyorix: Open-source secrets management for teams that can’t use SaaS
Keyorix is an open-source secrets manager that runs entirely on a company’s own servers. A secrets manager is the locked store where an application fetches the database…
Re: cloud computing provider disclosures
Posted by Demi Marie Obenour on Oct 04 - Xen Project already has its own predisclosure list. - KVM (sadly) falls under the Linux kernel security process. - Cloud…
CVE-2026-97631: Pre-boot RCE in EDK II PXE driver
Posted by Valtteri Vuorikoski on Oct 28 Ars Technica reported on this yesterday so let's have it here too. Copied from the advisory on the edk2 repo: Summary While a…
Upwind secures $400 million to protect AI across endpoints, code, and cloud
Upwind Security has raised $400 million in Series C funding to expand its cloud and AI security platform, bringing the company’s total funding to more than $800 million…