in-toto / witness

git clone https://github.com/in-toto/witness.git

Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.