Get involved — zegit

Who we are

We are a small team of engineers based in Sweden. We built zegit because we have lived the gap between "we follow good practice" and being able to prove it — the audit that reconstructs a story from CI logs, the release that nobody can say with certainty went through the right controls. That gap is uncomfortable enough at human scale. With autonomous coding agents entering the picture, it becomes a structural problem. The EU Cyber Resilience Act makes it a legal one.

We are opinionated about how good engineering works: test-driven, trunk-based, continuous delivery — not as a methodology preference but because those three disciplines are the structural prerequisites for a coherent, tamper-evident evidence record. The platform is pre-1.0 and under active development: zegit governs its own repositories (zegit, zg, watchsong and Common), the evidence record schema is at 0.1, and the CRA Annex I mapping is a draft awaiting expert review — which is exactly why design partners matter now.

Where we are

To be concrete about "pre-1.0" — so you know what you'd be looking at:

workingThe zg CLI — passkey login, local validation signed into an in-toto attestation, quorum-approved Tag Requests, release policy as a protected ref, CRA Evidence Bundles with offline verification. The gateway as zegit's own SSH gateway: it runs the checks on push and is the only writer to the protected branch on GitHub and Gitea, forwarding each push the Control Plane re-verifies. Pre-receive installers for Gitea, GitLab and other self-hosted forges ship too, but no customer host runs them yet. The hosted Control Plane at zegit.io — identity, Tag Requests, release policy, attestations, audit log, evidence pages. Signed releases at github.com/zegit-zoo/zg; meerkat is public and Apache-2.0.
in progressThe vulnerability-handling workflow and SBOM normalization, attested build-runner images with runner-signed attestations, and expert review of the CRA Annex I mapping.
plannedEnforcement on GitHub.com and GitLab.com (shadow mode first) and on GitHub Enterprise Server. Self-serve signup and billing (priced per governed repository — writers, readers and agents are unlimited), and hosted Git as a later premium option. The editor plugins are not yet published as releases. watchsong, the vulnerability disclosure service, is early-stage.

Want to try it first? Install zg from the latest release and follow Getting started.

Not ready to reach out yet? That's fine — say hello at info [at] zegit.dev and we'll keep you posted as things land. No list, no spam — just a reply when there's something real to show.

Two ways to get involved

Design partners

For teams who want provable delivery now — especially those facing CRA obligations or bringing coding agents into a regulated codebase. Work directly with us: shape the roadmap, get hands-on help wiring zegit into your pipeline, and influence the evidence model before it sets. We are taking a small number of design partners at this stage.

Backers

For people who want to support the initiative — angels, operators, and others who believe good engineering should be the path of least resistance and that compliance should fall out as a byproduct. Reach out to talk about backing zegit.

Get in touch

Email us at info [at] zegit.dev. Tell us which track interests you — design partner or backer — and a sentence about your setup or what drew you to the project. We read everything and reply to everything.

Found a security issue? Do not use the address above — report it to security [at] zegit.io as described in the security policy (RFC 9116; OpenPGP key available). We acknowledge within three business days.

Email info [at] zegit.dev