intoto

In-toto is an open-source framework for end-to-end verification of software supply chains. It provides a mechanism to capture and verify the provenance of artifacts such as source code, built binaries, container images, and release packages. The goal is to ensure that every meaningful step in the supply chain is performed as intended and that evidence of that execution is tamper-evident and verifiable by downstream consumers.

Central to in-toto are the concepts of layout and link records. A layout defines the expected steps in the supply chain, the materials entering and products produced by each step, the authorized keys that may attest to those steps, and any required ordering or dependencies among steps. A link is a signed record produced by an actual step, describing the materials observed, the products created, the command executed, and the outcome. Attestations can be chained and verified against the layout to confirm that the artifact was produced according to the defined plan.

In-toto is designed for integration with existing CI/CD pipelines and release workflows, supporting use-cases such as validating container images, package builds, and artifact signing. It is an open-source project with tooling and reference implementations in multiple languages, and is commonly used in conjunction with other provenance and security standards to strengthen software supply chain security. The project emphasizes interoperability, verifiability, and the ability to audit each step taken to produce a software artifact.