Build, sign, and verify Evidence Packs.

The official CLI and Go SDK for working with Evidence Packs. Create packs from artifacts, sign with Sigstore, push to registries, and compare over time.

Open source. Apache 2.0 licensed.

Install via

                Terminal
              
                brew install locktivity/tap/epack

Get Started CLI Reference Read the Spec →

epack demo

Build Package artifacts into Evidence Packs with a single command.

Sign Keyless signing with Sigstore. No keys to manage.

Verify Check integrity and verify signer identities.

Diff Compare packs to see what changed over time.

What's in a pack

A ZIP archive with a manifest, your evidence artifacts, and optional signatures.

            
              
            
            evidence.epack
          

            evidence.epack/
├── manifest.json         # Metadata, digests, sources
├── artifacts/            # Your evidence files
│   ├── soc2-report.pdf
│   ├── pentest-summary.pdf
│   └── github-posture.json
└── attestations/         # Optional signatures
    └── manifest.json.sigstore.json
          

manifest.json

Lists every file with its SHA-256 fingerprint. This is what makes packs verifiable and diffable.

artifacts/

The actual evidence: audit reports, pentest summaries, compliance docs, configuration exports.

attestations/

Optional

Sigstore signatures from tools or humans. Proves who created or verified the pack.

Quick Start

Try it in 30 seconds.

Create a project

epack new my-project && cd my-project

Creates a project with a sample pack and a managed .gitignore that keeps .epack/hooks/ tracked for repo-owned customization.

Explore the sample pack

              epack inspect sample.epack
epack verify sample.epack
            

Build and sign your own

              # Build a pack from your files
epack build evidence.epack ./reports/*.pdf --stream myorg/security

# Sign with Sigstore (opens browser)
epack sign evidence.epack
            

Full quickstart tutorial →

Automate evidence collection

Stop assembling packs by hand. Collectors pull evidence from your systems, tools analyze what you've gathered, utilities help you work with packs, and remotes push them to registries.

Collectors

Pull posture data from GitHub, AWS, Okta, Jira, Slack, and other systems.

Run on a schedule or trigger from CI.

Tools

Run policy checks, framework crosswalks, timeline analysis, and risk assessments.

Compliance analysis workflows.

Utilities

View packs interactively, query with AI, diff periods, and export to auditor formats.

Helper tools for GRC workflows.

Remotes

Push packs to registries with one command. Versioning and access control built-in.

Configure once, push anywhere.

Browse available components

Collectors for GitHub, AWS, Okta, Jira, and Slack. Tools for policy checks and risk assessment. Utilities for viewing and exporting packs. Add them to your epack.yaml and run epack collect.

Browse registry

Documentation

Everything you need to work with Evidence Packs.

Get Started

Install the CLI and build your first pack in under a minute.

Guides

Step-by-step tutorials for common workflows and use cases.

Reference

CLI commands, Go SDK, configuration, and error codes.

Concepts

Understand trust levels, profiles, and continuous assurance.

Looking for the Evidence Pack specification?

The format spec, governance model, and narrative documentation live at evidencepack.org.

Visit evidencepack.org →

Frequently asked questions

How do I install the CLI?

The easiest way is via Homebrew: brew install locktivity/tap/epack. Alternatively, if you have Go installed, run go install -tags components github.com/locktivity/epack/cmd/epack@v0.1.31. You can also download pre-built binaries from the GitHub releases page.

How does signing work? Do I need to manage keys?

No long-lived keys to manage. Evidence Packs use Sigstore for keyless signing. Run epack sign and authenticate via your identity provider (GitHub, Google, Microsoft). Every signature is recorded in a public transparency log, so verification works offline.

Can I generate packs from CI/CD?

Yes. In GitHub Actions, grant id-token: write and run epack sign. In other CI/CD systems, pass EPACK_OIDC_TOKEN explicitly. The Sigstore certificate embeds the commit SHA, repository, and workflow path, so the signature proves exactly which code generated the evidence.

Can I use epack as a Go library?

Yes. The pack, pack/builder, pack/verify, and sign packages are available for programmatic use. See the Go SDK reference for details.

How do I compare two packs?

Run epack diff old.epack new.epack. The output shows added, removed, and modified artifacts. Use --json for machine-readable output.

Where can I learn more about the Evidence Pack format?

The specification, governance model, and narrative documentation live at evidencepack.org. The spec defines the pack structure, manifest schema, and signing format.