TestifySec contributed Witness and Archivista to the in-toto project. The in-toto community roadmap records the donations as completed work.
Two projects with different responsibilities
Witness captures configured observations about software work and supports policy verification. Archivista stores and retrieves attestations. Both are part of the in-toto ecosystem, with project governance and contributions taking place upstream.Making these projects available to the community lets other teams inspect the implementation, propose changes, and build on the same attestation formats. It does not make every deployment or evidence producer trustworthy by default.
What the announcement proposed
The original announcement described plans to connect Archivista with The Update Framework (TUF) for policy distribution and freshness. That roadmap statement is historical. It is not evidence that a particular integration shipped in Witness, Archivista, or a commercial TestifySec release.
Participate or put it to work
The in-toto community repository contains participation information and project discussions. Use the maintained Witness documentation and each project’s release notes for implementation steps.
TestifySec’s commercial products have a separate support and release contract. Start with the TestifySec docs for CI/lock, Pushgate, and the platform. The open-source donation does not imply CNCF endorsement or certification of those products.
