in-toto

in-toto is a framework for securing software supply-chain integrity. It gives a consumer evidence about how a release moved from source and build work to a delivered artifact.

The framework has a narrow job. It checks whether a project followed a declared process. It does not decide that the process is wise, that the code is safe, or that every authorized actor is trustworthy.

The mental model

An in-toto deployment has three roles:

• The project owner defines the expected supply chain in a signed layout.
• A functionary performs a step and signs link metadata as evidence.
• A client verifies the delivered product against the signed layout and links.

signed layout
     ↓ defines
steps, authorized keys, artifact rules, inspections
     ↓ compared with
signed link metadata from completed steps
     ↓
verification result for the delivered artifact