Why I Joined TestifySec and Contribute to Witness & Archivista

Open source has always been the most exciting space for me. It is where learning, collaboration, and real-world impact come together.

Over the past two years I had already worked across CNCF projects and programs like GSoC and LFX, but I wanted to go deeper into a space that felt both technically meaningful and directly useful to modern infrastructure teams.

Why software supply chain security?

While exploring DevSecOps, I kept returning to the same question: how do we trust the process that builds and releases software? That led me toward software supply chain security and the tooling around attestations, provenance, and verification.

A lot of the ecosystem here is written in Go, which made it even more exciting for me. I wanted to contribute somewhere I could learn deeply, improve my Go skills, and work on problems that actually matter.

Why TestifySec?

Around that time I came across a TestifySec event around compliance and AI. I was already planning to explore tools like cosign and sigstore, so I reached out to learn more about their work and possible opportunities.

That led me to Witness and Archivista, two open source projects in the in-toto ecosystem.

What pulled me in

Witness is written in Go, so it immediately felt approachable. I found areas to improve, especially around testing and validation, and started contributing there. I also wrote a blog post on Witness to make the project easier to understand for others entering the space.

For me, the appeal was not just security as a buzzword. It was the combination of ownership, collaboration, and seeing your work improve a real open source tool used by others.

Where this goes next

I want to keep moving deeper into Golang, DevSecOps, and software supply chain security as a long-term direction. I am still early, but contributing to a CNCF graduate project under the in-toto ecosystem has already been one of the best ways to keep learning while making work that feels meaningful.