• Stars
    star
    225
  • Rank 177,187 (Top 4 %)
  • Language
    Go
  • License
    Other
  • Created over 3 years ago
  • Updated 3 months ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

in-toto Attestation Framework

in-toto Attestation Framework

The in-toto Attestation Framework provides a specification for generating verifiable claims about any aspect of how a piece of software is produced. Consumers or users of software can then validate the origins of the software, and establish trust in its supply chain, using in-toto attestations.

Learning about in-toto attestations

To get started, check out the overview of the in-toto Attestation Framework.

For a deeper dive, we recommend reading through our documentation to learn more about the goals of the in-toto Attestation Framework. If you encountered in-toto via the SLSA project, take a look at this blog post to understand how the two frameworks intersect and how you can use in-toto for SLSA.

Visit https://in-toto.io to learn about the larger in-toto project.

Working with in-toto attestations

The core of the in-toto Attestation Framework is the specification that defines the format for in-toto attestations and the metadata they contain.

We also provide a set of attestation predicates, which are metadata formats vetted by our maintainers to cover a number of common use cases.

For tooling integration, we provide protobuf definitions of the spec. We currently only provide language bindings for Go and Python.

Is your use case not covered by existing predicate types?

Take a look at the open issues or pull requests to see if your usage has already been reported. We can help with use cases, thinking through options, and questions about existing predicates. Feel free to comment on an existing issue or PR.

Want to propose a new predicate type?

If you still can't find what you're looking for, open a new issue or pull request. Before opening a request for a new metadata format, please review our New Predicate Guidelines.

Governance

The in-toto Attestation Framework is part of the in-toto project under the CNCF. For more information, see GOVERNANCE.md.

Use @in-toto/attestation-maintainers to tag the maintainers on GitHub.

Disclaimer

The in-toto Attestation Framework is still under development. We are in the process of developing tooling to enable better integration and adoption of the framework. In the meantime, please visit any of the language-specific in-toto implementations to become familiar with current tooling options.

More Repositories

1

in-toto

in-toto is a framework to protect supply chain integrity.
Python
868
star
2

witness

Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.
Go
409
star
3

in-toto-golang

A Go implementation of in-toto. in-toto is a framework to protect software supply chain integrity.
Go
128
star
4

demo

Securing Alice's, Bob's and Carl's software supply chain using in-toto
Python
83
star
5

community

in-toto is a framework to secure the software supply chain.
62
star
6

archivista

Archivista is a graph and storage service for in-toto attestations. Archivista enables the discovery and retrieval of attestations for software artifacts.
Go
56
star
7

specification

Specification and other related documents.
Python
37
star
8

in-toto-rs

A rust implementation of in-toto
Rust
32
star
9

supply-chain-compromises

22
star
10

go-witness

Go implementation of witness
Go
21
star
11

ITE

in-toto Enhancements
19
star
12

scai-demos

Software Supply Chain Attribute Integrity (SCAI) Demos and CLI tools
Go
18
star
13

attestation-verifier

Prototype in-toto attestation verifier based on ITE-10 and ITE-11 layouts
Go
15
star
14

friends

Friends of in-toto! A place to record integrations and adoptions of the in-toto specification.
Python
12
star
15

in-toto-java

A Java implementation of in-toto runlib
Java
12
star
16

kubectl-in-toto

Go
11
star
17

github-action

in-toto provenance github action
JavaScript
8
star
18

in-toto-webhook

Go
8
star
19

apt-transport-in-toto

in-toto transport for apt
Python
8
star
20

Dockerfiles

Dockerfile
5
star
21

totoify-grafeas

Python
4
star
22

in-toto-testing

Python
3
star
23

in-toto.io

The in-toto website and documentation
HTML
2
star
24

layout-web-tool

A flask app that helps to create, modify and visualize in-toto layouts.
Python
2
star
25

image-resources

This repo contains image-related resources for in-toto
1
star
26

in-toto-inspections

A set of common in-toto inspections
Python
1
star
27

ite-4-demo

Python
1
star
28

demo-jekyll

Metadata and scripts to secure a basic jekyll supply chain with in-toto and grafeas
Shell
1
star