OPEN SOURCE
Trust infrastructure
should be open.
The core of CDK — attestation generation, verification, standards-based evidence — is open source, free to run, and yours to inspect.
$ cargo install cdk
GETTING STARTED
Install to first attestation in four commands.
OPEN CORE
What's open, what's enterprise.
Everything needed to generate and verify evidence is free and open. Organizational-scale management is what you pay for.
OPEN SOURCE
- CI/CD integrations — GitHub, GitLab, Jenkins
- Attestation generation
- Cryptographic verification
- Standards-based evidence
- Local evidence storage
- APIs and SDKs
ENTERPRISE
- Multi-framework compliance mapping
- Centralized evidence management
- Long-term retention
- Organization-wide dashboards
- SSO and RBAC
- Audit workspaces
CLI REFERENCE
Five commands cover most workflows.
- cdk init
- Initialize CDK configuration in a repository.
- cdk attest
- Generate a signed attestation for the current event.
- cdk verify <file>
- Independently verify an attestation's signature and claims.
- cdk policy check
- Evaluate policy against a pending change before it merges.
- cdk graph <artifact>
- Inspect the complete evidence graph for an artifact.
REPOSITORY
One core. Pluggable integrations.
cdk/ ├── cli/ command-line interface ├── core/ attestation + verification engine ├── integrations/ │ ├── github-action/ │ ├── gitlab-ci/ │ └── jenkins-plugin/ └── sdks/ ├── go/ ├── typescript/ └── python/
ROADMAP
Open governance. Public roadmap.
Every design decision is documented and discussed in the open before it ships.
Shipped
GitHub Actions integration, Sigstore-based signing, local evidence store.
In Progress
GitLab CI integration, SBOM generation.
Planned
Terraform provider attestations, Kubernetes admission controller.