---
title: Conforma
software:
- conforma
inventors:
- conforma
labels:
  category: security
  layer: application
code:
- https://github.com/conforma/cli
blogs:
- https://conforma.dev/posts/
docs_features:
  go-integration:
    note: |
      [Conforma](https://conforma.dev/) uses the OPA go
      library to process rego policies when validating the signatures and
      attestations of container images and other software artifacts.
---

Securely verify supply chain artifacts, and enforce policies about how they were built and tested,
in a manageable, scalable, and declarative way.
