# in-toto/in-toto

in-toto is a framework to protect supply chain integrity.

Repository: https://github.com/in-toto/in-toto
Canonical: https://ross.abutalabs.com/products/in-toto
Homepage: https://in-toto.io
Language: Python
License: NOASSERTION
License Family: other
Topics: supply-chain, security, new-york-university, secure-systems-lab
Last push: 2026-08-05T03:30:39+00:00

## Health v2 (maintenance only)
Score: 81/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 96, release rhythm 50, longevity 100
- inputs: {"age_days": 3754, "days_push": 28, "days_rel": 121, "gap_med": null, "n_releases_24m": 1}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1032, forks 162 (observed 2026-08-28T04:03:18.309531+00:00)

## What it is
in-toto is a Python framework and reference implementation of the in-toto specification for protecting software supply chain integrity. It lets project owners define supply chain layouts and verifies that each step was performed by authorized functionaries without tampering, using signed link metadata.

## Use cases
- verify software supply chain integrity
- prove who ran each build and packaging step
- detect tampering in build artifacts
- define authorized steps for a software pipeline
- generate signed link metadata for supply chain steps
- verify a package was built as planned before installing

## When to choose
- you need cryptographically verifiable provenance for your software supply chain
- you want to enforce that only authorized personnel perform build steps
- you need an open CNCF-graduated standard with a Python reference implementation
- you want to detect supply chain compromises before end-user installation

## When to avoid
- you only need artifact signing without step-by-step supply chain verification
- you need a non-Python implementation and cannot use the reference library
- your project has no defined build or release pipeline to model

## Facets
- artifact type: library
- maturity: stable
- function: security, cryptography, developer-tools, cli, sdk
- domain: security, developer-tools
- platform: python, cli, cross-platform
- tags: supply-chain-security, software-supply-chain, metadata, attestation, cncf, provenance, verification, devops, automation

## Member repositories
- in-toto/in-toto (main) score 81

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:18.309531+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T07:06:44.956028+00:00, confidence not recorded.
  - readme: https://github.com/in-toto/in-toto (fetched 2026-08-28T04:03:18.309531+00:00, sha 855431d2161b)
  - homepage: https://in-toto.io (fetched 2026-08-29T13:06:53.357284+00:00, sha 043b69d22818)
  - site_page: https://in-toto.io/about (fetched 2026-08-29T13:06:53.359726+00:00, sha c6e7bf8c6e6e)
  - site_page: https://in-toto.io/docs (fetched 2026-08-29T13:06:53.361484+00:00, sha 51b5af79a5d3)
  - site_page: https://in-toto.io/docs/what-is-in-toto (fetched 2026-08-29T13:06:53.363143+00:00, sha 1c33a91a5243)
  - site_page: https://in-toto.io/docs/getting-started (fetched 2026-08-29T13:06:53.364812+00:00, sha 14d3add9c52a)
  - site_page: https://in-toto.io/docs/specs (fetched 2026-08-29T13:06:53.366790+00:00, sha 06459667f4b2)
  - site_page: https://in-toto.io/docs/security (fetched 2026-08-29T13:06:53.368363+00:00, sha 45de480be5a5)
  - registry_pypi: https://pypi.org/pypi/in-toto/json (fetched 2026-08-29T13:06:53.369993+00:00, sha 29554df27f5f)
- Data as of 2026-08-30T08:39:29.467469+00:00.