Resources
Understand the approach. See how it fits your team. Get it running.
Explore the problems behind developer and agent trust.
Connect the products to the work you need to trust.
Manage gates, inspect evidence, and demonstrate technical controls.
Review security practices, evidence trust boundaries, and security documents.
Witness and Archivista in Autodesk’s software delivery workflows.
Understand the commercial options and where the platform can run.
Use the documentation for setup, examples, and reference.
Research and standards
Publications our team helped shape, and the open specification our tooling builds on. Read the original sources and see where the ideas apply.
TestifySec PDF editionCNCF · Case study · February 2025
Provenance collection across CI/CD.
CNCF documents how Autodesk uses attestations to support software supply-chain controls and review.
The case study features Witness and Archivista, open-source projects created by TestifySec.
View the source attribution ↗Download TestifySec’s PDF edition ↗
Publication coverNIST · Special Publication · 2024
Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD Pipelines
A practical foundation for bringing supply chain security into build and delivery workflows.
Frederick Kautz co-authored this publication with Ramaswamy Chandramouli and Santiago Torres-Arias. NIST lists his affiliation as TestifySec.
View the source attribution ↗
Publication coverCNCF TAG Security · Community guidance · v1
The original community guide to securing the software supply chain.
Connects signing, verification, metadata, and automation to practical engineering decisions.
Cole Kennedy is named in the original contribution record for version 1.
View the source attribution ↗
Repository PDF · publication date placeholderCNCF TAG Security · Community guidance · v2 repository edition
Updated guidance for the people building and consuming software.
Covers attestation generation, distribution, verification and storage, including Witness and Archivista examples.
Version 2 credits the original white paper authors alongside its update authors. Cole Kennedy is named in the version 1 contribution record.
View the source attribution ↗
Original paperin-toto · Research paper · USENIX Security · 2019
A framework for software supply chain integrity.
Provides the common foundation for recording workflow steps and verifying evidence against policy.
Cole Kennedy and Frederick Kautz maintain Witness; Cole also maintains Archivista. These in-toto projects put attestation collection and storage into practice.
View the source attribution ↗Archivista maintainers ↗
Publication coverCNCF TAG Security · Reference architecture
An architecture for collecting and verifying software provenance.
Shows how workflow infrastructure, evidence collection, policy, and verification fit together.
Cole Kennedy is a named author in the web edition. Frederick Kautz is acknowledged for input and feedback.
View the source attribution ↗
Publication coverCNCF TAG Security · Community guidance · v2 · 2022
Security across the cloud native application lifecycle.
Places supply chain controls alongside identity, infrastructure, deployment, and runtime security.
Cole Kennedy and Frederick Kautz are both named contributors to version 2.
View the source attribution ↗
Book cover · CC BY 4.0SPIFFE community · Book · 2020
Establishing trust through workload identity with SPIFFE and SPIRE.
Explains how software workloads get verifiable identities—the foundation for deciding which evidence producers to trust.
Frederick Kautz is one of the book’s 12 co-authors. The first edition was written by members of the SPIFFE community in 2020.
View the source attribution ↗Cover: Henrik Van Leeuwen · CC BY 4.0 ↗Looking for company resources?
