mkit-attest

An mkit attestation is an in-toto v1 Statement (a typed predicate about a subject) sealed in a DSSE envelope and attached to a commit. Downstream consumers verify it against a trust-roots registry — the set of public keys they're willing to trust. The subject is always a commit (its BLAKE3 id); the predicate is your claim (provenance, code review, SBOM, test results, …).

The chain is: signed commit → one or more DSSE attestations → verify against trust roots. A commit must already be signed (mkit keygen first); attestation adds claims on top of the commit signature.

Attestation signer keys

Attestation signers are separate from the Ed25519 commit key and are written by keygen --algorithm: