Beta — Werfty is under active development. Interfaces may change between releases.

Werfty

Werfty is a software supply chain trust platform. It generates, signs, and verifies SBOM attestations for Docker images and Python packages — so every deploy can prove what it ships.

Built for CRA Article 14 compliance: Werfty covers the SBOM generation and attestation obligations for manufacturers of products with digital elements.

OCI Registry → CRA Compliance →

What is Werfty?

Werfty is a trust registry that generates, cryptographically signs, and verifies SBOMs for any software component. Designed for teams with EU Cyber Resilience Act obligations, it provides cryptographic proof that your artifacts are exactly what you built.

werfty-generate

Scans your watchlist and generates CycloneDX SBOMs for Docker images and Python packages.

werfty-attest

Signs SBOMs with cosign and pushes attestations to the OCI trust registry for permanent storage.

werfty-verify

Verifies signatures and retrieves SBOMs for any component in your supply chain.

werfty-triage coming soon

Automated CVE triage with mandatory human gate before any remediation is applied.

Trust registry

OCI-compatible registry at trust.werfty.io storing all signed SBOMs, accessible by image reference.

Who it's for: Software manufacturers, DevSecOps teams, and OSS projects with CRA compliance requirements.

Cosign-signed SBOM attestations

Werfty signs a tamper-proof SBOM directly against your Docker image or PyPI package — anyone can verify it hasn't changed.

Standard OCI storage

Attestations live in a standard OCI registry alongside your images — no proprietary silo, no lock-in. Addressable by image ref.

CI-scriptable verification

One command, werfty-verify, tells you whether a package's SBOM is trusted, untrusted, or missing. A failed verification blocks the deploy — a passing one lets it through.

Offline signing workflow

Generate your SBOM in one environment and sign it in another — your signing keys never touch your build servers.

How it works

  1. Generate

    Run werfty-generate against your Docker image or PyPI package to produce a signed SBOM.

  2. Attest

    Run werfty-attest to push the SBOM as a cosign attestation to your OCI registry.

  3. Verify

    Run werfty-verify docker <image> or werfty-verify pypi <package> — in CI or locally — to confirm the attestation is valid.

Public trust registry

trust.werfty.io is the hosted OCI endpoint for SBOM attestations. Learn how to pull and verify or go straight to the raw OCI endpoint. Self-hosting with Zot also works.