in-toto/in-toto

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

1032 stars · 162 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

in-toto is a Python framework and reference implementation of the in-toto specification for protecting software supply chain integrity. It lets project owners define supply chain layouts and verifies that each step was performed by authorized functionaries without tampering, using signed link metadata.

Use cases

• verify software supply chain integrity
• prove who ran each build and packaging step
• detect tampering in build artifacts
• define authorized steps for a software pipeline
• generate signed link metadata for supply chain steps
• verify a package was built as planned before installing

When to choose

• you need cryptographically verifiable provenance for your software supply chain
• you want to enforce that only authorized personnel perform build steps
• you need an open CNCF-graduated standard with a Python reference implementation
• you want to detect supply chain compromises before end-user installation

When to avoid

• you only need artifact signing without step-by-step supply chain verification
• you need a non-Python implementation and cannot use the reference library
• your project has no defined build or release pipeline to model

Facets

library · maturity stable

security cryptography developer-tools cli sdk security developer-tools python cli cross-platform supply-chain-security software-supply-chain metadata attestation cncf provenance verification devops automation

Member repositories

For agents

markdown · JSON · MCP: product_card(name="in-toto/in-toto")