Witness: Open-source framework for verifying how your software was built