Show HN: CI/lock – supply-chain attestation CLI, from the Witness creators

Category: security

Tags: supply-chain-security, attestation, in-toto, cli, ci-cd

Score: 5.3/10 (Innovation: 6, Technical: 5, Documentation: 4, Utility: 5)

CI/lock is a supply-chain attestation CLI from the creators of Witness that captures execution evidence from builds and agent workspaces and produces signed in-toto attestations. It emphasizes separating evidence production from policy acceptance, with short-lived signing credentials and integration with a Pushgate for Git push-time verification.

Target audience: devops, security engineers, platform teams, backend developers

Repository: https://cilock.dev/blog/signed-record-we-didnt-have-in-march/

View on Hacker News