Witness, an open source software supply chain tool, signs each build step and fails artifacts that break a signed policy.