attest
A local-first compliance evidence engine: collect security posture facts inside a client's boundary, review them in plaintext, seal them for transport, map them to framework controls, and emit signed OSCAL assessment results.
Spec v0.1 published · no implementation yetWhat attest is
Evidence gets collected once per framework, by hand, and goes stale between audits. The fix is to collect facts once, with provenance on every one, and map them to whichever controls need them.
attest collects posture facts inside the client's own
boundary. The client reviews every fact in plaintext before anything
leaves. The reviewed set is signed and sealed for transport. On the
assessor's side the facts are mapped to framework controls, and the
output is a signed OSCAL assessment results document plus a readable
summary. The core makes no network calls. Think terraform plan for
compliance evidence: declarative, diffable, provenance on everything.
It is for small security teams and consultants who answer to more than one framework.
The v0.1 specification ships one crosswalk, NIST SP 800-171 r2, with a starter set of seven controls. Crosswalks are YAML modules, one file per framework, so a further framework is an added file rather than a rewrite. Nothing beyond that one file is in scope for v0.1.
Spec-first. The v0.1 specification is published. There is no implementation yet. Source is public at github.com/attesting/attest.
Licensed MIT.
Signing key fingerprint
Commits in the attest repository are signed with this
OpenPGP key. This page is where that fingerprint is published.
The key also carries an older uid for commits signed before this one was added.
This page and the key it links to are the authoritative source for
this fingerprint. Anything else claiming to carry a signing key for
attest, such as a keyserver entry, a mirror, or a copy
pasted into an email, is only as good as its agreement with what is
published here. If a copy disagrees with this page, trust the page and
report the copy.
Public key
/signing-key.asc: ASCII-armored OpenPGP public key, served as plain text.
curl -sO https://attesting.dev/signing-key.asc gpg --import signing-key.asc gpg --fingerprint 2B96CD0E01A862E650A12C68D4F471A935E054FD
Importing a key proves nothing on its own. Verify that the fingerprint printed by the last command matches the one above, character for character, before relying on it.
Release checksums
There is no binary to verify, and any artifact claiming to be a
release of attest at this time did not come from this
project. When the first release ships, this section will carry a
SHA256SUMS file and a detached signature over it,
alongside an SBOM and reproducible-build instructions.
Source
- Repository github.com/attesting/attest
- Overview and status README.md
- Specification SPEC.md: authoritative v0.1 engineering specification
- Verification posture VERIFYING.md: how to check commits today, and how released binaries will be checked once they exist
- Documentation docs/: predicate registry, fact classes, crosswalk authoring, threat model
Nothing on this page depends on the repository: the fingerprint above and the key beside it are published here, and here is where they are authoritative. If the fingerprint in VERIFYING.md ever disagrees with this page, trust the page and open an issue.