{"id":51646450,"url":"https://github.com/kanywst/wimsey","last_synced_at":"2026-07-13T23:02:27.629Z","repository":{"id":368225022,"uuid":"1284082295","full_name":"kanywst/wimsey","owner":"kanywst","description":"A vendor-neutral WIMSE (Workload Identity in Multi System Environments) reference implementation in Rust — WIT, WPT, RFC 9421 HTTP signatures, and mTLS/WIC.","archived":false,"fork":false,"pushed_at":"2026-07-07T14:10:09.000Z","size":141,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-07T15:21:02.417Z","etag":null,"topics":["dpop","ed25519","http-message-signatures","identity","ietf","jose","jwt","mtls","mutual-tls","reference-implementation","rfc9421","rust","spiffe","wimse","workload-identity","x509","zero-trust"],"latest_commit_sha":null,"homepage":"https://github.com/kanywst/wimsey","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kanywst.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":"GOVERNANCE.md","roadmap":"ROADMAP.md","authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":"MAINTAINERS.md","copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-29T14:03:35.000Z","updated_at":"2026-07-07T14:11:24.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/kanywst/wimsey","commit_stats":null,"previous_names":["kanywst/wimsey"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/kanywst/wimsey","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kanywst%2Fwimsey","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kanywst%2Fwimsey/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kanywst%2Fwimsey/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kanywst%2Fwimsey/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kanywst","download_url":"https://codeload.github.com/kanywst/wimsey/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kanywst%2Fwimsey/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35439213,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-13T02:00:06.543Z","response_time":119,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dpop","ed25519","http-message-signatures","identity","ietf","jose","jwt","mtls","mutual-tls","reference-implementation","rfc9421","rust","spiffe","wimse","workload-identity","x509","zero-trust"],"created_at":"2026-07-13T23:02:26.958Z","updated_at":"2026-07-13T23:02:27.613Z","avatar_url":"https://github.com/kanywst.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# wimsey\n\n[![ci](https://github.com/kanywst/wimsey/actions/workflows/ci.yml/badge.svg)](https://github.com/kanywst/wimsey/actions/workflows/ci.yml)\n[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/kanywst/wimsey/badge)](https://scorecard.dev/viewer/?uri=github.com/kanywst/wimsey)\n[![License: Apache-2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)\n\n**A vendor-neutral reference implementation of the IETF\n[WIMSE](https://datatracker.ietf.org/wg/wimse/about/) workload-identity specs,\nin Rust.**\n\nWIMSE (Workload Identity in Multi System Environments) standardizes how software\nworkloads prove their identity to one another. The working group publishes\nspecifications but no reference code — `wimsey` fills that gap with a clean,\nspec-faithful implementation plus cross-implementation conformance vectors that\nany vendor can validate against.\n\n\u003e **Pre-alpha.** The specs are Internet-Drafts (no RFC yet) and `wimsey` pins\n\u003e specific draft revisions in [`SPEC-MAP.md`](SPEC-MAP.md). Not production-ready.\n\n## How it works\n\nA workload gets a signed **Workload Identity Token (WIT)** from an issuer, then\nproves possession of its key whenever it calls a peer.\n\n```mermaid\nflowchart LR\n    W[Workload] -- \"1 - identifier + PoP key\" --\u003e ISS[wimsey-issuer]\n    ISS -- \"2 - WIT, signed by the issuer\" --\u003e W\n    W -- \"3 - WIT + proof of possession\" --\u003e P[Peer service]\n    P -- \"4 - verify the WIT, then the proof\" --\u003e P\n```\n\nThe proof of possession is one of three interchangeable bindings:\n\n- a **Workload Proof Token (WPT)** — a DPoP-style JWT bound to the WIT;\n- an **RFC 9421 HTTP Message Signature** over the request carrying the WIT;\n- **mutual TLS** with a **Workload Identity Certificate (WIC)**, the X.509-SVID\n  shape SPIFFE uses.\n\n## Components\n\n| Crate | Role | Spec |\n| --- | --- | --- |\n| `wimsey-identifier` | Workload identifier URI scheme | `draft-ietf-wimse-identifier` |\n| `wimsey-wit` | Workload Identity Token (WIT / WIC) | `draft-ietf-wimse-workload-creds` |\n| `wimsey-wpt` | Workload Proof Token | `draft-ietf-wimse-wpt` |\n| `wimsey-httpsig` | HTTP Message Signatures binding | `draft-ietf-wimse-http-signature` |\n| `wimsey-mtls` | mTLS binding (WIC) | `draft-ietf-wimse-mutual-tls` |\n| `wimsey-cli` | The `wimsey` command-line tool | — |\n| `wimsey-issuer` | Experimental HTTP issuer | — |\n\n## Quick start\n\n```bash\n# Install the CLI once (or prefix each command with `cargo run -p wimsey-cli --`).\ncargo install --path crates/cli\n\n# An issuer key and a workload proof-of-possession key.\nwimsey key generate --out issuer.jwk\nwimsey key generate --out pop.jwk\n\n# Issue a WIT for a workload, then verify it.\nwimsey wit issue --issuer-key issuer.jwk --cnf-key pop.jwk \\\n  --sub spiffe://example.org/api --iss https://issuer.example \u003e wit.txt\nwimsey wit verify --issuer-jwk issuer.jwk --token-file wit.txt\n\n# Prove possession with a WPT, then verify the WIT and proof together.\nwimsey wpt new --pop-key pop.jwk --wit \"$(cat wit.txt)\" \\\n  --aud https://service.example/transfer \u003e wpt.txt\nwimsey wpt verify --issuer-jwk issuer.jwk --wit \"$(cat wit.txt)\" \\\n  --aud https://service.example/transfer --proof \"$(cat wpt.txt)\"\n```\n\nThe same WIT can instead be carried in an RFC 9421 HTTP signature\n(`wimsey httpsig sign|verify`) or an mTLS client certificate. Run\n`wimsey --help`, or start the issuer with `cargo run -p wimsey-issuer`.\n\n## Documentation\n\n- [Roadmap](ROADMAP.md) — the phased plan toward CNCF Sandbox readiness.\n- [Spec map](SPEC-MAP.md) — the pinned IETF draft revisions per crate.\n- [CNCF Sandbox readiness](docs/cncf-sandbox.md) — criteria checklist and draft\n  application.\n- [Changelog](CHANGELOG.md).\n\n## Community\n\nContributions are welcome under the [DCO](CONTRIBUTING.md). Please read the\n[Code of Conduct](CODE_OF_CONDUCT.md), the [governance](GOVERNANCE.md) and\n[maintainers](MAINTAINERS.md), and the [security policy](SECURITY.md). Using\n`wimsey`? Add yourself to [`ADOPTERS.md`](ADOPTERS.md).\n\n## License\n\nLicensed under the [Apache License, Version 2.0](LICENSE).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkanywst%2Fwimsey","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkanywst%2Fwimsey","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkanywst%2Fwimsey/lists"}