An attestation that disappears with a CI log is difficult to reuse. Archivista addresses the storage and retrieval part of the software supply-chain evidence workflow.
The challenge
A release can have evidence from several jobs: a build, a vulnerability scan, a test suite, and a deployment check. Reviewers need to find the records associated with the artifact they are evaluating, even when those records came from different systems.
Introducing Archivista
Archivista is an in-toto subproject that stores attestations and exposes a GraphQL interface for finding and retrieving them. It provides a place to retain evidence and relate it to artifact identifiers.
Storage and verification are separate operations. Successfully retrieving a record does not establish that its signer is authorized or that its claims satisfy your policy.
Key features
- Retain signed attestation envelopes for later use.
- Find evidence using artifact identifiers and supported query fields.
- Connect evidence from different supply-chain steps for review.
Deployment-specific access controls, retention, and backup arrangements must be configured and assessed separately. The presence of an in-toto statement does not itself provide access control, a complete audit trail, or a guarantee that the statement is true.
Additional benefits
A shared evidence store allows a build team, a release gate, and a control owner to refer to the same record. That reduces the need to reconstruct results from screenshots or disconnected logs.
The verifier still needs to check the artifact digest, the expected producer, the signature, the required results, and any freshness requirements. Evidence that was never captured cannot be reconstructed by the store.
