Help Net Security

Witness: Open-source framework for verifying how your software was built

Witness, an open source software supply chain tool, signs each build step and fails artifacts that break a signed policy.