# Secure Supply Chain with Archivista

Source: https://www.testifysec.com/blog/secure-supply-chain-with-archivista/

Author: TestifySec

Published: 2023-07-15

Updated: 2026-10-06

How Archivista helps secure your software supply chain with attestation storage.

Editorial update · October 6, 2026

Updated by TestifySec Editorial to clarify the trust boundaries and replace incomplete migrated instructions with maintained references. The original publication date and article URL are unchanged.

- [Witness documentation ↗](https://witness.dev/)
- [Current TestifySec docs →](https://www.testifysec.com/docs)
- [Trust architecture →](https://www.testifysec.com/docs/cilock/trust)

An attestation that disappears with a CI log is difficult to reuse. [Archivista](https://github.com/in-toto/archivista) addresses the storage and retrieval part of the software supply-chain evidence workflow.

 

## The challenge

 

A release can have evidence from several jobs: a build, a vulnerability scan, a test suite, and a deployment check. Reviewers need to find the records associated with the artifact they are evaluating, even when those records came from different systems.

 

## Introducing Archivista

 

Archivista is an in-toto subproject that stores attestations and exposes a GraphQL interface for finding and retrieving them. It provides a place to retain evidence and relate it to artifact identifiers.

 

Storage and verification are separate operations. Successfully retrieving a record does not establish that its signer is authorized or that its claims satisfy your policy.

 

## Key features

 

- Retain signed attestation envelopes for later use.
 - Find evidence using artifact identifiers and supported query fields.
 - Connect evidence from different supply-chain steps for review.

 

Deployment-specific access controls, retention, and backup arrangements must be configured and assessed separately. The presence of an in-toto statement does not itself provide access control, a complete audit trail, or a guarantee that the statement is true.

 

## Additional benefits

 

A shared evidence store allows a build team, a release gate, and a control owner to refer to the same record. That reduces the need to reconstruct results from screenshots or disconnected logs.

 

The verifier still needs to check the artifact digest, the expected producer, the signature, the required results, and any freshness requirements. Evidence that was never captured cannot be reconstructed by the store.

 

## Where it fits today

 [Witness](https://witness.dev/) remains an open-source option for generating and verifying attestations. In the TestifySec product workflow, [CI/lock](https://www.testifysec.com/docs/cilock/getting-started/first-attestation) captures the work, Pushgate checks the push, and the [platform](https://www.testifysec.com/product) manages gates and technical control evidence. Read the [trust architecture](https://www.testifysec.com/docs/pushgate/trust-architecture) before deciding which producer and gate should be authoritative in your environment.