Tool

in-toto

A framework for cryptographically verifying software supply-chain steps via link metadata and layouts.

in-toto.io

Where it helps

• Govern the Factory and the Product Separately

  Link metadata captures authorised factory steps independently of the running product.

• Evidence by Default

  Attestations and layouts are machine-checkable evidence of how software was produced.

• Governance is Version Controlled

  Layouts and links are versioned, signed artefacts rather than informal process claims.