The in-toto Attestation Framework provides a specification for generating verifiable claims about any aspect of how a piece of software is produced. Consumers or users of software can then validate the origins of the software, and establish trust in its supply chain, using in-toto attestations.
To get started, check out the overview of the in-toto Attestation Framework.
For a deeper dive, we recommend reading through our documentation to learn more about the goals of the in-toto Attestation Framework. If you encountered in-toto via the SLSA project, take a look at this blog post to understand how the two frameworks intersect and how you can use in-toto for SLSA.
Visit https://in-toto.io to learn about the larger in-toto project.
The core of the in-toto Attestation Framework is the specification that defines the format for in-toto attestations and the metadata they contain.
We also provide a set of attestation predicates, which are metadata formats vetted by our maintainers to cover a number of common use cases.
For tooling integration, we provide protobuf definitions of the spec. We currently only provide language bindings for Go and Python.
Take a look at the open issues or pull requests to see if your usage has already been reported. We can help with use cases, thinking through options, and questions about existing predicates. Feel free to comment on an existing issue or PR.
If you still can't find what you're looking for, open a new issue or pull request. Before opening a request for a new metadata format, please review our New Predicate Guidelines.
The in-toto Attestation Framework is part of the in-toto project under the CNCF. For more information, see GOVERNANCE.md.
Use @in-toto/attestation-maintainers to tag the maintainers on GitHub.
Stay up-to-date with the latest activities and discussions in the in-toto Attestation Framework by exploring the maintainers' notes.
The in-toto Attestation Framework is still under development. We are in the process of developing tooling to enable better integration and adoption of the framework. In the meantime, please visit any of the language-specific in-toto implementations to become familiar with current tooling options.