A client library for Witness, written in Go.

This library is currently pre-1.0 and therefore the API may be subject to breaking changes.

• Creation and signing of in-toto attestations
• Verification of in-toto attestations and associated signatures with:
  • Witness policy engine
  • OPA Rego policy language
• A growing list of attestor types defined under a common interface
• A selection of attestation sources to search for attestation collections

For more detail regarding the library itself, we recommend viewing pkg.go.dev. For the documentation of the witness project, please view the main witness repository.

In order to effectively contribute to this library, you will need:

• A Unix-compatible Operating System
• GNU Make
• Go 1.19

This repository uses Go tests for testing. You can run these tests by executing make test.