in-toto
in-toto is a framework for proving that a software release passed through the expected supply-chain steps, performed by authorized people or systems, without unauthorized artifact changes.
itCloud native tools and technologies | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Intro
in-toto
in-toto is a framework for securing software supply-chain integrity. It gives a consumer evidence about how a release moved from source and build work to a delivered artifact.
The framework has a narrow job. It checks whether a project followed a declared process. It does not decide that the process is wise, that the code is safe, or that every authorized actor is trustworthy.
The mental model
An in-toto deployment has three roles:
- The project owner defines the expected supply chain in a signed layout.
- A functionary performs a step and signs link metadata as evidence.
- A client verifies the delivered product against the signed layout and links.
signed layout
↓ defines
steps, authorized keys, artifact rules, inspections
↓ compared with
signed link metadata from completed steps
↓
verification result for the delivered artifact
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://in-toto.io/
Supports
- in-toto as a framework for securing software supply-chain integrity
- The goal of making performed steps, actors, and order transparent
- https://in-toto.io/docs/getting-started/
Supports
- Signed layouts defining steps and authorized functionaries
- Signed link metadata for commands, materials, products, and functionaries
- Artifact-rule types and the default behavior for unmatched artifacts
- in-toto-run, in-toto-record, in-toto-sign, and in-toto-verify
- Inputs required for final-product verification
- https://github.com/in-toto/docs/blob/master/in-toto-spec.md
Supports
- Roles of project owner, functionary, and client
- Layout, link, artifact, material, product, and verification definitions
- Link metadata structure and supply-chain workflow
- Artifact-rule semantics and cross-step relationships
- https://in-toto.io/docs/specs/
Supports
- Stable in-toto specification availability
- Stable in-toto Attestation Framework specification availability
- https://in-toto.readthedocs.io/en/stable/
Supports
- Python reference implementation scope
- Available evidence-generation and verification tooling
- Metadata-model and layout-creation documentation
- https://in-toto.readthedocs.io/en/stable/command-line-tools/in-toto-verify.html
Supports
- Layout signature and expiry checks
- Link thresholds, authorized functionary signatures, and artifact-rule checks
- Sequential execution of inspection commands
- Required verification key and optional link-directory inputs
- https://github.com/bureado/awesome-software-supply-chain-security
Supports
- Discovery of adjacent supply-chain security projects for awesome links
- https://slsa.dev/
Supports
- SLSA as an adjacent supply-chain security framework
- https://www.sigstore.dev/
Supports
- Sigstore signing and verification infrastructure
- https://github.com/guacsec/guac
Supports
- GUAC collection and query of software-supply-chain metadata