Software traceability for regulated industries
An audit, an incident, a supplier delivery: you need to explain how a software version was produced. Attest generates a signed receipt linking declared files, build steps and the delivered software. Your quality teams, security teams and auditors get a record they can check for integrity.
Start with one critical release, your technical team and the people responsible for reviewing it.
Evidence travels with your software
The receipt links the build to the delivered software. Its integrity can be checked offline.
From release to evidence
Your teams select a release and declare the files and steps to record within the existing build process.
Attest records the steps, their results and fingerprints of declared inputs and outputs during execution.
With signing enabled, Attest seals this information in a receipt to keep with the release and include in your audit file.
The recipient checks receipt integrity using keys they approve. The review relies on trust in the signer and the build environment.
For your decisions
IT, security and quality leaders: work from a shared record to review a delivery, investigate a discrepancy and respond to an audit request.
Keep a signed receipt with each release, recording the steps and fingerprints of declared files. Your teams can retrieve this evidence without reconstructing the history from scattered logs.
File fingerprints let your teams compare declared files across runs. An optional check runs the pipeline twice and compares the results to test reproducibility.
With the receipt and approved trusted keys, a reviewer can check the signature offline, without access to your build platform or an Attest service.
Request a receipt alongside delivered software and compare its fingerprint with the recorded one. in-toto export lets you pass provenance records to your partners’ compatible tools.
Sectors
An audit to prepare for, a version to accept, an incident to investigate: Attest serves organisations that need to document how their critical software was built.
Sectors
Your challenge
How Attest helps
Your IT leadership needs to document changes to a critical service, including supplier deliveries. During an audit or incident, identifying the version and its build history becomes a priority.
A signed receipt links declared steps and files to the delivered version. It provides a traceability record to accompany your approvals and change controls.
Your quality team is preparing the file for a software version or model intended for a medical device. It needs to connect that version to retained build records and checks.
Declare the software, model and test reports as pipeline outputs. The receipt records their fingerprints to document the version reviewed in your quality file.
You accept a supplier delivery in a restricted environment. Your teams need to examine its provenance records without opening their network to an external service.
Transfer the receipt and approved keys under your own procedures. Verify the signature on an isolated workstation, without access to the supplier’s system or an Attest service.
Your operations leadership needs to retain software version records for installations with long service lives. Maintenance or an incident may require tracing their origin.
Keep each version’s receipt in your document management process. Recorded fingerprints and steps provide build traceability even after the original platform has changed.
Your programme lead needs to document the binary delivered to the customer and the materials used to build it. Multiple teams and subcontractors contribute to the delivery file.
Attach a signed receipt recording fingerprints of declared source files, configuration and outputs. It complements the records reviewed by your quality teams and customer.
Evaluate Attest
Choose the software to trace, the records to produce and who will check them. Use this scope to evaluate Attest before expanding its use.
A focused scope
Your teams can add the CLI to an existing step and produce a first signed receipt. The public reference describes commands for signing, key management and verification.
Explore the integration pathCommercial licence
Discuss your environment, evidence requirements and usage terms with us. The repository licence covers non-commercial use; commercial use requires a separate licence.
Discuss your scopeStart with an upcoming audit, critical software or a customer requirement. Identify the evidence needed and an initial scope to evaluate with your teams.