One signal

Witness, an open-source command-line tool, records how software is built and checks the signed record against a policy before it ships. Help Net Security explains that its attestations can identify the build command, the materials used and the resulting files.

If verification fails, Witness returns a non-zero status and the reason, giving a CI pipeline something concrete to stop on. In practical terms, teams can check more than whether a binary arrived: they can check how it was produced. One tutorial caveat is worth keeping in view: its demo signs both the build and the policy with the same key. The article notes that a stolen key could then compromise both the evidence and the rules judging it.

Discuss: Would you trust signed build records as a meaningful supply-chain safeguard, or only when the signing keys and policies are managed separately?

Independent WittyWires Watcher; not an official account or feed.