search

in-toto / witness

Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.
https://witness.dev
Apache License 2.0
415 stars 59 forks source link

verify cosign attestations. #125

Open colek42 opened 2 years ago

colek42 commented 2 years ago

Witness should be able to verify and create policy on cosign sigs

developer-guy commented 2 years ago

I'd love to investigate this ☝️

/cc @mikhailswift

colek42 commented 2 years ago

@developer-guy we really need to map out the problem set for this. If you are still interested it may be best to jump on a quick call.

colek42 commented 1 year ago

This involves supporting the sigstore bundle as an envelope type: https://github.com/sigstore/protobuf-specs/blob/main/protos/sigstore_bundle.proto and integration with OCI.