Securing Alice's, Bob's and Carl's software supply chain using in-toto

A Go implementation of in-toto. in-toto is a framework to protect software supply chain integrity.

Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.

Go implementation of witness

Archivista is a graph and storage service for in-toto attestations. Archivista enables the discovery and retrieval of attestations for software artifacts.

in-toto Attestation Framework

Friends of in-toto! A place to record integrations and adoptions of the in-toto specification.

in-toto is a framework to protect supply chain integrity.

Software Supply Chain Attribute Integrity (SCAI) Demos and CLI tools

The in-toto website and documentation