witness:基于 in-toto 生态的软件供应链审计与策略验证工具

Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.