Witness Examples

• Verifying an artifact policy

In this example you will create a witness attestation and policy for an artifact and verify it. This example includes verifying a step policy with a rego policy.

• Using Fulcio as a Signer Provider

In this example you will use Sigstore's Fulcio service as a signer provider for witness. This example also includes verifying the ephemeral key used to sign the attestation using a timestamp authority.

• Stopping a SolarWinds Attack

In this example you will use Witness' tracing feature to detect and stop a process tampering attack.

• Using Vault's PKI Secret Engine as a Key Provider

In this example you will use Vault's PKI Secrets Engine as a signer provider for witness.