in-toto: A Framework to Secure Software Supply Chain Integrity

In-toto: A framework to secure the integrity of software supply chains

I present in-toto, a CNCF graduated project designed to guarantee software integrity from creation to installation. This open standard makes every step of the supply chain transparent, revealing exactly what actions were taken, by whom, and in what order. With extensive tooling and broad adoption, in-toto empowers developers to build trust and security directly into their software products.

"in-toto is designed to ensure the integrity of a software product from initiation to end-user installation."