Open source attestation projects
Every project in the registry tagged attestation, ranked by real GitHub adoption.
The open‑source AI Agents Governance & Orchestration framework: write the rules declaratively, Bernstein enforces them and produces the verifiable, replayable r
SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more
Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.
Frequently asked questions
How many open source attestation projects are there?
This registry tracks 3 projects tagged attestation, with 2,318 GitHub stars between them. The most-adopted is bernstein at 1,190 stars.
Are these attestation projects free to use?
Yes — 3 of the 3 carry an explicit open-source licence across 1 distinct licence, so there is no licence fee. Where a project also sells a hosted or enterprise version, the self-hosted path remains free.
Which attestation project should I choose?
The list above is ranked by GitHub stars, but stars measure attention rather than fit. Check three things on each card: the licence (permissive versus copyleft), the language it is written in, and the last-push date — a high-star project that has not been pushed in a year is a liability.
Are these attestation projects still maintained?
3 of the 3 were pushed in the last 90 days, and every card shows its exact last-push date so you can see the rest. Sort your shortlist by that date before committing to a migration.