witness
Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.
Community interest
Community forks
Observed snapshot change
Repository metadata
Star history & growth
Observed snapshots only. Missing observations are not invented.
Collecting project history
A chart needs at least two observations. Newly indexed projects accumulate real snapshots over time.
Inspect recent observations
| Date | Stars |
|---|---|
| 2026-10-05 | 547 |
| 2026-10-06 | 547 |
| 2026-10-07 | 547 |
| 2026-10-08 | 547 |
| 2026-10-09 | 547 |
| 2026-10-10 | 547 |
| 2026-10-11 | 547 |
| 2026-10-12 | 548 |
| 2026-10-13 | 548 |
| 2026-10-14 | 548 |
| 2026-10-15 | 549 |
| 2026-10-16 | 549 |
| 2026-10-17 | 549 |
| 2026-10-18 | 549 |
| 2026-10-19 | 549 |
| 2026-10-20 | 551 |
| 2026-10-21 | 551 |
| 2026-10-22 | 551 |
| 2026-10-23 | 552 |
| 2026-10-24 | 552 |
| 2026-10-25 | 554 |
| 2026-10-26 | 606 |
| 2026-10-27 | 613 |
| 2026-10-28 | 614 |
| 2026-10-29 | 614 |
| 2026-10-30 | 614 |
| 2026-10-31 | 615 |
| 2026-11-01 | 615 |
| 2026-11-02 | 615 |
| 2026-11-03 | 616 |
Get the source & start here
Cloning downloads source; follow official setup and dependency instructions.
git clone https://github.com/in-toto/witness.gitAbout this project
What is witness?
Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.
How do I get started?
Clone with git clone https://github.com/in-toto/witness.git. Cloning is not a complete installation; follow the official README for dependencies, hosts and usage.
Can I use it commercially?
Current license information: Apache-2.0. Review the original terms, dependencies and your intended use.
What do maintenance and growth indicate?
Current status: Recently maintained. Activity is not a security audit. Growth uses collected snapshots; missing baselines are not estimated.