github.com/testifysec/witness (go): Witness is a pluggable framework for software supply chain risk management.  It automates, normalizes, and verifies software artifact provenance.
Keywords: attestation|security|security-tools|supply-chain|verification