# Witness and Archivista Join the in-toto Project

Source: https://www.testifysec.com/blog/witness-donation/

Author: TestifySec Team

Published: 2023-09-07

Updated: 2026-10-06

The open-source contribution, the responsibilities of each project, and where to find maintained documentation.

From the archive · edited October 6, 2026

Edited by TestifySec Editorial to clarify the historical announcement, restore primary sources, and separate earlier plans from current product support. The published URL and date are retained.

- [Current TestifySec docs →](https://www.testifysec.com/docs)
- [Trust architecture →](https://www.testifysec.com/docs/cilock/trust)

TestifySec contributed Witness and Archivista to the in-toto project. The [in-toto community roadmap](https://github.com/in-toto/community/blob/main/ROADMAP.md) records the donations as completed work.

 

## Two projects with different responsibilities

 [Witness](https://witness.dev/docs/) captures configured observations about software work and supports policy verification. [Archivista](https://github.com/in-toto/archivista) stores and retrieves attestations. Both are part of the in-toto ecosystem, with project governance and contributions taking place upstream. 

Making these projects available to the community lets other teams inspect the implementation, propose changes, and build on the same attestation formats. It does not make every deployment or evidence producer trustworthy by default.

 

## What the announcement proposed

 

The original announcement described plans to connect Archivista with The Update Framework (TUF) for policy distribution and freshness. That roadmap statement is historical. It is not evidence that a particular integration shipped in Witness, Archivista, or a commercial TestifySec release.

 

## Participate or put it to work

 

The [in-toto community repository](https://github.com/in-toto/community) contains participation information and project discussions. Use the maintained [Witness documentation](https://witness.dev/docs/) and each project’s release notes for implementation steps.

 

TestifySec’s commercial products have a separate support and release contract. Start with the [TestifySec docs](https://www.testifysec.com/docs) for CI/lock, Pushgate, and the platform. The open-source donation does not imply CNCF endorsement or certification of those products.