in-toto

in-toto is an open-source framework that records and verifies each step of a software supply chain using signed link metadata and project owner-defined layouts. It enables verification that artifacts are built, tested, and packaged by authorized functionaries without unauthorized tampering.

Adding cryptographic provenance and step-by-step verification to build pipelines and artifact distribution.

• +Cryptographically links build steps to functionaries and artifacts.
• +Supports multiple language implementations and CI/CD integrations.
• +Applies to any file artifacts in a supply chain, such as source code, executables, and packages.

• +Requires careful layout design and key management to be effective.
• +Adoption depends on integrating in-toto metadata into existing build and release processes.

Detecting unauthorized modifications in build, test, and release pipelines before artifacts are consumed.