Go modules · #2418

github.com/in-toto/witness

v0.12.0in-toto/witness ↗

Last release 13 days ago
15 Aug 2026
Release timing varies
gaps range from 8 days to 5 months
Some releases are documented
notes for 9 of 17 stable releases
Nothing withdrawn
no release was ever pulled
3 years old
72 releases · first in 2023

Release timeline

72 releases since 2023

202420252026

Releases

v0.12.010 Jul 2026

Release notes

Witness v0.12.0

This release upgrades the embedded go-witness library from v0.10.0 to v0.12.0, pulling in two upstream releases at once. The most important of these is a large coordinated-disclosure security hardening release in go-witness v0.12.0 that strengthens policy verification, artifact tracing, and timestamp checks. On the Witness CLI side, this release adds first-class support for experimental attestors, unlocking the new networktrace attestor.

All users are strongly encouraged to upgrade to pick up the security fixes below.

🔐 Security (via go-witness v0.12.0)

go-witness v0.12.0 landed a consolidated set of coordinated-disclosure fixes (go-witness#784). Because Witness embeds go-witness for all attestation collection and policy verification, these fixes apply directly to witness run and witness verify.

Published advisories

Advisory	Severity	Summary
GHSA-2v4r-xhmm-ghv8	High	Policy-signature verification accepted certificates whose signature had actually failed, allowing a forged policy to be trusted. Verifiers with a failed signature are now rejected.
GHSA-v6px-jqx8-8xwj	Medium	The file attestor followed symlinks resolving outside the attested root and recorded out-of-tree files. Such symlinks are now refused for following and directory hashing.
GHSA-vmvj-p3hw-39q3	Medium	An `artifactsFrom` edge could be satisfied with no genuine artifact flow. Zero-overlap edges are now rejected and failure reasons de-duplicated.
GHSA-5qp5-ph6r-qj9f	Low	RFC 3161 timestamp verification did not require the `id-kp-timeStamping` EKU. A sole critical timestamping EKU is now required on the TSA signer and its chain re-verified.
GHSA-r4fv-8r9j-vgcg	Low	With a duplicated attestor type, rego was evaluated only against the last instance, letting a malicious attestor shadow policy. Every attestor of a type is now evaluated.
GHSA-g9jx-rqhm-mj7g	Low	An empty collection name matched any step in `validateAttestations`. An exact collection-name match is now required.
GHSA-pgpm-j729-qcvh	Low	Cross-step artifact comparison could downgrade to the weakest shared hash (e.g. SHA-1), enabling collision-based substitution. Strongest-size hash ties are now resolved deterministically in `DigestSet.Equal`.

Defense-in-depth hardening (no published advisory)

These GHSA IDs were assigned but the reports were not accepted as vulnerabilities; the release still ships secure-default changes for each:

GHSA-mpvw-hw8p-7x27 — Policy certificate-identity constraints defaulted to a wildcard *, so trusting a CA effectively accepted any certificate it issued. Explicit-empty constraints are now distinguished from unset, and x509 policy signers must opt in to an identity.
GHSA-rgp5-33mp-jhfm — A policy defining zero steps verified successfully (failed open). Such a policy now fails verification.
GHSA-567m-4668-m656 — A step declaring no required attestations performed no content checks. Steps with no required attestations now fail closed.
GHSA-c346-qp3r-53vf — Policy.Verify merged step results across search depth without de-duplication, inflating quorum/coverage. Merged step results are now de-duplicated.
GHSA-3vpg-3m94-v3qr — The system-packages attestor invoked rpm/dpkg-query by bare name off an untrusted $PATH. Package-manager binaries are now resolved from trusted directories.

✨ New Features

Experimental attestors

Witness now supports invoking and listing attestors that go-witness marks as experimental (#775, by @Vyom-Yadav):

witness run gains an --experimental flag. Experimental attestors are refused unless it is set:

attestor <name> is experimental and cannot be used without --experimental flag
witness attestors list gains -e/--experimental to include experimental attestors in the listing (shown with an (experimental) suffix).

`networktrace` attestor (via go-witness v0.11.0)

The first experimental attestor available through the flag above is networktrace (go-witness#629), which records network activity during a witness run using an invisible TCP proxy. Combine --experimental with -a networktrace to try it.

🐛 Bug Fixes (via go-witness v0.11.0 / v0.12.0)

verify: Prevent a nil-pointer panic in the Archivista client during witness verify (go-witness#689).
tracing: Properly clean up ENOENT files for child processes in the Linux command-run tracer (go-witness#772).
tracing: Fix Linux builds on unsupported architectures in the tracing helpers (go-witness#688).

🔧 Maintenance

Bumped go-witness to v0.12.0 (#797).
Updated dependencies to clear reachable vulnerabilities: Go 1.26.4, golang.org/x/crypto, golang.org/x/net (#786).
Added a guide on how to write attestors (#756).
CI: Save attestations and upload them to the workflow run instead of sending to Archivista (#787).
Routine dependency and GitHub Actions bumps (go-git, opa, k8s.io/apimachinery, and grouped go-mod/gha/npm updates).

Contributors

Thanks to @Vyom-Yadav, @Jaydeep869, @fkautz, and @jkjell for their contributions to this release.

Full changelog: v0.11.0...v0.12.0 · go-witness: v0.10.0...v0.12.0

Open source →

Additional notes

v0.12.0 Latest

Latest

Compare

Choose a tag to compare

Open source →

v0.11.1-0.20260815012010-3041b832ddcc15 Aug 2026pre-release
Nothing published for this version
v0.11.1-0.20260726212532-9f32682747f026 Jul 2026pre-release
Nothing published for this version
v0.11.1-0.20260724114303-f5f8dc8e8eaf24 Jul 2026pre-release
Nothing published for this version
v0.11.1-0.20260710132927-5bcbe85e59cf10 Jul 2026pre-release
Nothing published for this version
v0.11.014 Apr 2026
Release notes
Changelog

Bug fixes
- e4e91a6: fix(policy): add public key validation in policy check command (#749) (@Jaydeep869)
- 772b369: fix: properly retain attestor options on witness run (#750) (@Jaydeep869)
Others
- 5342829: chore: bump github.com/go-git/go-git/v5 from 5.16.0 to 5.16.5 (#722) (@dependabot[bot])
- d76696c: chore: bump the all-gha group across 1 directory with 8 updates (#720) (@dependabot[bot])
- 120b88a: chore: bump the all-go-mod group across 1 directory with 5 updates (#723) (@dependabot[bot])
- 0b4c575: chore: bump github.com/theupdateframework/go-tuf/v2 from 2.3.0 to 2.4.1 (#718) (@dependabot[bot])
- 1074111: chore: bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 (#715) (@dependabot[bot])
- edc05ac: chore: bump undici from 7.16.0 to 7.18.2 in /docs-website in the npm_and_yarn group across 1 directory (#710) (@dependabot[bot])
- 3059e31: chore: bump the npm_and_yarn group across 1 directory with 4 updates (#724) (@dependabot[bot])
- e7785ee: chore: bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (#726) (@dependabot[bot])
- 67fa1d2: chore: bump github/codeql-action from 4.32.2 to 4.32.3 in the all-gha group (#725) (@dependabot[bot])
- f93583e: fix(archivista client): nil pointer dereference (#676) (@manzil-infinity180)
- 66c6d50: chore: bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 (#730) (@dependabot[bot])
- b030acf: chore: bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 (#731) (@dependabot[bot])
- e101901: chore: bump the all-gha group across 1 directory with 7 updates (#733) (@dependabot[bot])
- 542c8fd: chore: bump the all-go-mod group across 1 directory with 2 updates (#732) (@dependabot[bot])
- 99de651: chore: bump svgo from 2.8.0 to 2.8.2 in /docs-website in the npm_and_yarn group across 1 directory (#734) (@dependabot[bot])
- a072dc7: chore: bump github.com/docker/cli from 29.0.3+incompatible to 29.2.0+incompatible (#735) (@dependabot[bot])
- 02901b9: chore: bump the all-gha group across 1 directory with 7 updates (#737) (@dependabot[bot])
- 9521a68: Fix Aditya's name (#738) (@adityasaky)
- 35a7aff: chore: bump undici from 7.18.2 to 7.24.1 in /docs-website in the npm_and_yarn group across 1 directory (#739) (@dependabot[bot])
- 8c1032c: chore: bump the all-go-mod group with 2 updates (#740) (@dependabot[bot])
- 44b8404: chore: bump google.golang.org/grpc from 1.79.1 to 1.79.3 (#741) (@dependabot[bot])
- c598df6: chore: bump k8s.io/apimachinery from 0.35.2 to 0.35.3 in the all-go-mod group (#742) (@dependabot[bot])
- b1613d0: chore: bump yaml from 1.10.2 to 1.10.3 in /docs-website in the npm_and_yarn group across 1 directory (#744) (@dependabot[bot])
- 043b0fa: chore: bump the all-gha group across 1 directory with 5 updates (#745) (@dependabot[bot])
- 34290a1: chore: bump node-forge from 1.3.2 to 1.4.0 in /docs-website in the npm_and_yarn group across 1 directory (#746) (@dependabot[bot])
- f1b5254: chore: bump github.com/open-policy-agent/opa from 1.14.1 to 1.15.0 in the all-go-mod group (#747) (@dependabot[bot])
- 698876d: chore: bump github.com/go-git/go-git/v5 from 5.16.5 to 5.17.1 (#748) (@dependabot[bot])
- f9ba228: chore: bump github.com/buger/jsonparser from 1.1.1 to 1.1.2 (#751) (@dependabot[bot])
- bfe3bf4: chore: bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#752) (@dependabot[bot])
- c9d1520: chore: bump picomatch from 2.3.1 to 2.3.2 in /docs-website in the npm_and_yarn group across 1 directory (#754) (@dependabot[bot])
- 5a8d811: chore: bump lodash from 4.17.23 to 4.18.1 in /docs-website in the npm_and_yarn group across 1 directory (#755) (@dependabot[bot])
- a4658e4: chore: bump github.com/open-policy-agent/opa from 1.15.0 to 1.15.1 in the all-go-mod group (#759) (@dependabot[bot])
- d481de6: chore: bump the all-gha group across 1 directory with 5 updates (#766) (@dependabot[bot])
- 70dd040: chore: bump axios from 1.13.5 to 1.15.0 in /docs-website in the npm_and_yarn group across 1 directory (#764) (@dependabot[bot])
- 31b8225: chore: bump github.com/open-policy-agent/opa from 1.15.1 to 1.15.2 in the all-go-mod group across 1 directory (#765) (@dependabot[bot])
- fbd3199: chore: bump github.com/sigstore/timestamp-authority/v2 from 2.0.3 to 2.0.6 (#767) (@dependabot[bot])
- 8de1d7d: chore: bump follow-redirects from 1.15.11 to 1.16.0 in /docs-website in the npm_and_yarn group across 1 directory (#768) (@dependabot[bot])
- 4f94e9f: Update deps (#762) (@jkjell)
Open source →
Additional notes
v0.11.0

Compare

Choose a tag to compare

Open source →
v0.10.213 Jan 2026
Release notes
Changelog

Features
- e10a919: feat(policy): add policy check command (#681) (@manzil-infinity180)
Documentation
- e9c1361: docs(attestor): vex, secretscan, k8smanifest, system-packages (#679) (@manzil-infinity180)
Others
- 9ac9b5d: chore: added documentation for omnitrail attestor (#673) (@manzil-infinity180)
- 5b7b17d: chore: bump the all-gha group across 1 directory with 5 updates (#680) (@dependabot[bot])
- 188e65f: chore: bump golang.org/x/crypto from 0.39.0 to 0.45.0 (#686) (@dependabot[bot])
- c81b3f1: chore: bump the all-gha group across 1 directory with 7 updates (#688) (@dependabot[bot])
- 61da106: chore: bump node-forge from 1.3.1 to 1.3.2 in /docs-website in the npm_and_yarn group across 1 directory (#689) (@dependabot[bot])
- 262527b: chore: bump github.com/sigstore/fulcio from 1.7.1 to 1.8.3 (#690) (@dependabot[bot])
- 360684a: chore: bump the all-go-mod group across 1 directory with 4 updates (#692) (@dependabot[bot])
- 154fb32: chore: bump the all-gha group with 4 updates (#693) (@dependabot[bot])
- ac66267: chore: bump mdast-util-to-hast from 13.2.0 to 13.2.1 in /docs-website in the npm_and_yarn group across 1 directory (#694) (@dependabot[bot])
- d1dbbe7: chore: bump the all-gha group with 6 updates (#699) (@dependabot[bot])
- 68ccf8b: test: add cmd/config (#677) (@manzil-infinity180)
- 7998f21: chore: update gorelease config to enable immutable releases (#696) (@jkjell)
- 9be09ec: chore: bump the all-go-mod group with 3 updates (#701) (@dependabot[bot])
- e157ad6: chore: bump the all-gha group across 1 directory with 2 updates (#703) (@dependabot[bot])
- 09b07ed: chore: bump github.com/open-policy-agent/opa from 1.12.1 to 1.12.2 in the all-go-mod group (#705) (@dependabot[bot])
- fd39378: chore: bump qs from 6.13.0 to 6.14.1 in /docs-website in the npm_and_yarn group across 0 directory (#706) (@dependabot[bot])
- e714d76: chore: update maintainers and affiliations (#708) (@mikhailswift)
- dfa9faf: chore: bump github.com/sigstore/cosign/v2 from 2.5.0 to 2.6.2 (#707) (@dependabot[bot])
- 0af1bb5: chore: bump github.com/sigstore/fulcio from 1.8.4 to 1.8.5 (#709) (@dependabot[bot])
Open source →
Additional notes
v0.10.2

Compare

Choose a tag to compare

Open source →
v0.10.2-rc59 Dec 2025pre-release
Release notes
Changelog

Features
- e10a919: feat(policy): add policy check command (#681) (@manzil-infinity180)
Documentation
- e9c1361: docs(attestor): vex, secretscan, k8smanifest, system-packages (#679) (@manzil-infinity180)
Others
- 9ac9b5d: chore: added documentation for omnitrail attestor (#673) (@manzil-infinity180)
- 5b7b17d: chore: bump the all-gha group across 1 directory with 5 updates (#680) (@dependabot[bot])
- 188e65f: chore: bump golang.org/x/crypto from 0.39.0 to 0.45.0 (#686) (@dependabot[bot])
- c81b3f1: chore: bump the all-gha group across 1 directory with 7 updates (#688) (@dependabot[bot])
- 61da106: chore: bump node-forge from 1.3.1 to 1.3.2 in /docs-website in the npm_and_yarn group across 1 directory (#689) (@dependabot[bot])
- 262527b: chore: bump github.com/sigstore/fulcio from 1.7.1 to 1.8.3 (#690) (@dependabot[bot])
- 360684a: chore: bump the all-go-mod group across 1 directory with 4 updates (#692) (@dependabot[bot])
- 154fb32: chore: bump the all-gha group with 4 updates (#693) (@dependabot[bot])
- ac66267: chore: bump mdast-util-to-hast from 13.2.0 to 13.2.1 in /docs-website in the npm_and_yarn group across 1 directory (#694) (@dependabot[bot])
- 86d2585: chore: update gorelease config to enable immutable releases (@jkjell)
Open source →
Additional notes
v0.10.2-rc5 Pre-release

Pre-release

Compare

Choose a tag to compare

Open source →
v0.10.2-rc49 Dec 2025pre-release
Nothing published for this version
v0.10.2-rc39 Dec 2025pre-release
Nothing published for this version
v0.10.2-rc29 Dec 2025pre-release
Nothing published for this version
v0.10.2-rc19 Dec 2025pre-release
Nothing published for this version
v0.10.2-0.20251215222855-68ccf8b9741e15 Dec 2025pre-release
Nothing published for this version
v0.10.2-0.20251112035728-e10a919ec45f12 Nov 2025pre-release
Nothing published for this version
v0.10.2-0.20251023171641-9ac9b5da303423 Oct 2025pre-release
Nothing published for this version
v0.10.115 Oct 2025
Release notes
Changelog

Changes from go-witness v0.9.1
- feat(schemagen): only update schema files when content changes by @colek42 in in-toto/go-witness#506
- feat: add MultiExporter interface for multiple attestation exports by @colek42 in in-toto/go-witness#507
- feat(attestation): adds aws codebuild attestor by @kriscoleman in in-toto/go-witness#477
- fix(ci): updates tsa server url and ca by @kriscoleman in in-toto/go-witness#531
- added test for gitlab attestation by @manzil-infinity180 in in-toto/go-witness#553
- log failed attestor name for better debugging by @rabajaj0509 in in-toto/go-witness#565
- feat: Add Azure Key Vault KMS core implementation by @fkautz in in-toto/go-witness#529
- signer/file: add passphrase support for encrypted PKCS#8 keys; add tests by @fkautz in in-toto/go-witness#564
- fix(fulcio): improve fulcio signer resilience and error handling by @kriscoleman in in-toto/go-witness#568
- add the current valid AWS certs to valid AWS identity documents by @jkjell in in-toto/go-witness#576
Bug fixes
- 143f0e7: fix: gitignore profile.cov file (#632) (@manzil-infinity180)
- b23aebc: fix: links in the concepts/attestor (#646) (@manzil-infinity180)
- c007331: fix(docs): witness run cmd in kms (#656) (@manzil-infinity180)
Documentation
- 34f5f2d: docs: add TestifySec sponsorship to README (#607) (@colek42)
- 43209a6: docs: added development steps to CONTRIBUTING.MD (#642) (@manzil-infinity180)
- 8457db6: docs: add azure key vault (#665) (@manzil-infinity180)
Others
- 65e9180: Make getting started the first item. (#624) (@matglas)
- 57538fa: Remove announcement bar with docs survey callout (#626) (@ChaosInTheCRD)
- b0ffd87: test: added for the options/sign.go (#637) (@manzil-infinity180)
- 4a6fc81: test: added for the options/root.go (#638) (@manzil-infinity180)
- 27138ac: test: add cmd/version.go (#633) (@manzil-infinity180)
- 2ded5fb: test: added for the options/verify.go (#640) (@manzil-infinity180)
- 16d15de: fix the link of Sigstore Cosign project (#647) (@manzil-infinity180)
- 00c6bda: add docker attester usage docs (#653) (@rabajaj0509)
- 6db12a8: test: add for the options/run.go (#641) (@manzil-infinity180)
- 38ffa99: fix the favicon path in docusaurus config file (#669) (@manzil-infinity180)
- ba902d8: Update to v0.9.1 of go-witness (#672) (@jkjell)
Open source →
Additional notes
v0.10.1

Compare

Choose a tag to compare

Open source →
v0.10.014 Oct 2025
Release notes
Changelog

Features
- 2ad5fe1: feat(test): added test for SignCmd (#635) (@manzil-infinity180)
- a4a3afb: feat(test): added test for log.go (#636) (@manzil-infinity180)
- 5927c64: feat: added test for the cmd/attestors and cmd/completion (#650) (@manzil-infinity180)
Bug fixes
- 143f0e7: fix: gitignore profile.cov file (#632) (@manzil-infinity180)
- b23aebc: fix: links in the concepts/attestor (#646) (@manzil-infinity180)
- c007331: fix(docs): witness run cmd in kms (#656) (@manzil-infinity180)
Documentation
- 34f5f2d: docs: add TestifySec sponsorship to README (#607) (@colek42)
- 43209a6: docs: added development steps to CONTRIBUTING.MD (#642) (@manzil-infinity180)
- 8457db6: docs: add azure key vault (#665) (@manzil-infinity180)
Others
- bd04d3b: chore: bump the all-gha group with 5 updates (#601) (@dependabot[bot])
- d27ff8a: chore: bump github.com/olekukonko/tablewriter from 0.0.5 to 1.0.2 in the all-go-mod group (#597) (@dependabot[bot])
- 95bb89d: chore: bump ossf/scorecard-action from 2.4.1 to 2.4.2 in the all-gha group (#603) (@dependabot[bot])
- 9b8f2e0: chore: bump github.com/olekukonko/tablewriter from 1.0.6 to 1.0.7 in the all-go-mod group (#604) (@dependabot[bot])
- abedf58: Update README with origin statement and support information (#611) (@colek42)
- 3fb4da0: chore: bump github/codeql-action from 3.28.18 to 3.28.19 in the all-gha group (#610) (@dependabot[bot])
- 94769a4: chore: bump the all-gha group with 3 updates (#614) (@dependabot[bot])
- d99fae8: chore: bump k8s.io/apimachinery from 0.33.1 to 0.33.2 in the all-go-mod group (#615) (@dependabot[bot])
- 48d4756: chore: bump sigstore/cosign-installer from 3.8.2 to 3.9.0 in the all-gha group (#616) (@dependabot[bot])
- 8c2b5bd: chore: bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 in the go_modules group (#617) (@dependabot[bot])
- d585ad8: chore: bump the all-gha group with 2 updates (#618) (@dependabot[bot])
- f600048: chore: bump github.com/olekukonko/tablewriter from 1.0.7 to 1.0.8 in the all-go-mod group (#619) (@dependabot[bot])
- 8b77986: chore: bump the all-gha group with 3 updates (#620) (@dependabot[bot])
- cd5498e: chore: bump the all-gha group with 3 updates (#621) (@dependabot[bot])
- f31243b: chore: bump the all-go-mod group with 2 updates (#622) (@dependabot[bot])
- 6a3aa8a: chore: bump form-data from 4.0.1 to 4.0.4 in /docs-website in the npm_and_yarn group across 1 directory (#623) (@dependabot[bot])
- d616c95: chore: bump the all-gha group with 3 updates (#625) (@dependabot[bot])
- 65e9180: Make getting started the first item. (#624) (@matglas)
- 57538fa: Remove announcement bar with docs survey callout (#626) (@ChaosInTheCRD)
- 42f88d4: chore: bump github/codeql-action from 3.29.4 to 3.29.5 in the all-gha group (#628) (@dependabot[bot])
- 27982d2: chore: bump github.com/olekukonko/tablewriter from 1.0.8 to 1.0.9 in the all-go-mod group (#629) (@dependabot[bot])
- 57c4500: chore: bump the all-gha group with 4 updates (#630) (@dependabot[bot])
- b0ffd87: test: added for the options/sign.go (#637) (@manzil-infinity180)
- d762d03: chore: bump k8s.io/apimachinery from 0.33.3 to 0.33.4 in the all-go-mod group (#644) (@dependabot[bot])
- d616c78: chore: bump the all-gha group with 3 updates (#643) (@dependabot[bot])
- 4a6fc81: test: added for the options/root.go (#638) (@manzil-infinity180)
- 27138ac: test: add cmd/version.go (#633) (@manzil-infinity180)
- 2ded5fb: test: added for the options/verify.go (#640) (@manzil-infinity180)
- a36653e: chore: bump github.com/go-viper/mapstructure/v2 from 2.3.0 to 2.4.0 in the go_modules group (#645) (@dependabot[bot])
- 6f458cf: chore: bump github.com/stretchr/testify from 1.10.0 to 1.11.0 in the all-go-mod group (#648) (@dependabot[bot])
- e3d30f7: chore: bump the all-gha group with 3 updates (#649) (@dependabot[bot])
- 16d15de: fix the link of Sigstore Cosign project (#647) (@manzil-infinity180)
- 9a43c2b: chore: bump actions/dependency-review-action from 4.7.2 to 4.7.3 in the all-gha group (#652) (@dependabot[bot])
- 00c6bda: add docker attester usage docs (#653) (@rabajaj0509)
- 6db12a8: test: add for the options/run.go (#641) (@manzil-infinity180)
- 1d95648: chore: bump axios from 1.8.2 to 1.12.1 in /docs-website in the npm_and_yarn group across 1 directory (#658) (@dependabot[bot])
- 7ed05f2: chore: bump the all-go-mod group across 1 directory with 6 updates (#662) (@dependabot[bot])
- a96fbfb: chore: bump the all-gha group with 7 updates (#664) (@dependabot[bot])
- dd170dd: chore: bump the all-gha group with 3 updates (#667) (@dependabot[bot])
- 38ffa99: fix the favicon path in docusaurus config file (#669) (@manzil-infinity180)
- 0134527: chore: bump the all-gha group with 2 updates (#670) (@dependabot[bot])
- 9a344c6: Update go-witness version (#671) (@jkjell)
- ba902d8: Update to v0.9.1 of go-witness (#672) (@jkjell)
Open source →
Additional notes
v0.10.0

Compare

Choose a tag to compare

Open source →
v0.9.216 May 2025
Release notes
v0.9.2

Compare

Choose a tag to compare

Open source →
v0.9.128 Apr 2025
Release notes
v0.9.1

Compare

Choose a tag to compare

Open source →
v0.9.1-rc228 Apr 2025pre-release
Nothing published for this version
v0.9.1-rc128 Apr 2025pre-release
Nothing published for this version
v0.9.1-0.20250428193652-67d820e7688b28 Apr 2025pre-release
Nothing published for this version
v0.9.1-0.20250417003058-3b0efb772d0917 Apr 2025pre-release
Nothing published for this version
v0.9.016 Apr 2025
Release notes
v0.9.0

Compare

Choose a tag to compare

Open source →
v0.8.110 Mar 2025
Release notes
v0.8.1

Compare

Choose a tag to compare

Open source →
v0.8.017 Feb 2025
Nothing published for this version
v0.7.1-0.20241209075056-a566f4c70a479 Dec 2024pre-release
Nothing published for this version
v0.7.05 Dec 2024
Nothing published for this version
v0.6.3-beta9 Sept 2024pre-release
Nothing published for this version
v0.6.1-0.20241204200307-d0b3826313844 Dec 2024pre-release
Nothing published for this version
v0.6.1-0.20241203182328-a720a4df0d413 Dec 2024pre-release
Nothing published for this version
v0.6.1-0.20241118184247-96763022bb8e18 Nov 2024pre-release
Nothing published for this version
v0.6.1-0.20241106010203-d0a27fbc278a6 Nov 2024pre-release
Nothing published for this version
v0.6.1-0.20240826142548-ea8d33c2e1ef26 Aug 2024pre-release
Nothing published for this version
v0.6.1-0.20240729134435-2dbe8b5f4c4829 Jul 2024pre-release
Nothing published for this version
v0.6.1-0.20240709002926-3ecffc4f93829 Jul 2024pre-release
Nothing published for this version
v0.6.1-0.20240706015640-6ae94d6c0a566 Jul 2024pre-release
Nothing published for this version
v0.6.017 Jun 2024
Nothing published for this version
v0.5.213 Jun 2024
Nothing published for this version
v0.4.1-0.20240528213038-6ab0464f514f28 May 2024pre-release
Nothing published for this version
v0.4.1-0.20240522030909-bb49495ad51122 May 2024pre-release
Nothing published for this version
v0.4.1-0.20240520220633-16beb9e7f5de20 May 2024pre-release
Nothing published for this version
v0.4.017 May 2024
Nothing published for this version
v0.4.0-beta219 Apr 2024pre-release
Nothing published for this version
v0.4.0-beta119 Apr 2024pre-release
Nothing published for this version
v0.4.0-beta10 Apr 2024pre-release
Nothing published for this version
v0.3.2-0.20240417132950-406b2bdbae5c17 Apr 2024pre-release
Nothing published for this version
v0.3.2-0.20240327152713-74f6c3dcb07a27 Mar 2024pre-release
Nothing published for this version
v0.3.2-0.20240306224225-910d630e4e2e6 Mar 2024pre-release
Nothing published for this version
v0.3.2-0.20240306154208-a4c40293f2a56 Mar 2024pre-release
Nothing published for this version
v0.3.2-0.20240305011727-e54d8be3e1ed5 Mar 2024pre-release
Nothing published for this version
v0.3.14 Mar 2024
Nothing published for this version
v0.3.019 Feb 2024
Nothing published for this version
v0.3.0-beta-kms12 Feb 2024pre-release
Nothing published for this version
v0.2.2-beta-18 Feb 2024pre-release
Nothing published for this version
v0.2.1-beta-16 Jan 2024pre-release
Nothing published for this version
v0.2.1-0.20240219152449-0df242bbb57919 Feb 2024pre-release
Nothing published for this version
v0.2.1-0.20240216211256-c27a4f56260816 Feb 2024pre-release
Nothing published for this version
v0.2.1-0.20240206141151-0e7dda9274d76 Feb 2024pre-release
Nothing published for this version
v0.2.1-0.20240129135743-58d5516f61ba29 Jan 2024pre-release
Nothing published for this version

github.com/in-toto/witness

Release timeline

Releases

Witness v0.12.0

🔐 Security (via go-witness v0.12.0)

Published advisories

Defense-in-depth hardening (no published advisory)

✨ New Features

Experimental attestors

networktrace attestor (via go-witness v0.11.0)

🐛 Bug Fixes (via go-witness v0.11.0 / v0.12.0)

🔧 Maintenance

Contributors

Choose a tag to compare

Changelog

Bug fixes

Others

Choose a tag to compare

Changelog

Features

Documentation

Others

Choose a tag to compare

Changelog

Features

Documentation

Others

Choose a tag to compare

Changelog

Changes from go-witness v0.9.1

Bug fixes

Documentation

Others

Choose a tag to compare

Changelog

Features

Bug fixes

Documentation

Others

Choose a tag to compare

Choose a tag to compare

Choose a tag to compare

Choose a tag to compare

Choose a tag to compare

`networktrace` attestor (via go-witness v0.11.0)

Changes from `go-witness` v0.9.1