in-toto

A framework to secure the integrity of software supply chains

in-toto is designed to ensure the integrity of a software product from initiation to end-user installation. It does so by making it transparent to the user what steps were performed, by whom and in what order.

Open, extensible standard

An open metadata standard that you can implement in your software’s supply chain.

Adoptions and Integrations

Explore integrations and adopters of in-toto.

Extensive tooling

Use in-toto today by through Apache-licensed libraries and tools.

in-toto is a CNCF incubating project.