KubeCon + CloudNativeCon India 2026

State-sponsored supply chain attacks, like the Shai Hulud worm, highlight the urgent need for automated, cryptographically verifiable attestations generated at the moment the supply chain executes, capturing execution details that directly improve the accuracy of secure SDLC documents like SBOMs.

Witness, an in-toto subproject, is one such tool that records various aspects of a system during supply chain execution. Unlike static lock files generated by toolchains, which often miss components and lack cryptographically verifiable metadata, Witness captures a complete and verifiable picture of what was actually executed. New observability features now enable Witness to enrich SBOMs with accurate, runtime-derived data, while also establishing a network baseline for supply chain execution.