Pluggable CLI tool for handling software artifact provenance
conda install chenghlee::witness
Witness is a pluggable framework for software supply chain risk management that automates, normalizes, and verifies software artifact provenance.