in-toto: A Framework to Secure Software Supply Chain Integrity
In-toto: A framework to secure the integrity of software supply chains
I present in-toto, a CNCF graduated project designed to guarantee software integrity from creation to installation. This open standard makes every step of the supply chain transparent, revealing exactly what actions were taken, by whom, and in what order. With extensive tooling and broad adoption, in-toto empowers developers to build trust and security directly into their software products.
in-toto is designed to ensure the integrity of a software product from initiation to end-user installation.
- yoshuaw
I thought this was a good explainer on what In-toto is, when to use it, and how it's different from e.g. Sigstore:
https://nesbitt.io/2026/05/24/signing-is-for-the-bad-days.ht...
- mrbluecoat
Feels way too over-engineered
https://github.com/in-toto/specification/blob/v1.0/in-toto-s...
- fathermarz
The issue with software supply chain is that you have to be in step the entire chain and developers are creative. I don’t have to pull in a dependency when I can copy paste code out of third party repos or stack overflow.
Also this doesn’t take into consideration one of the ugliest sides of SSC which is M&A. Sure on a completely greenfield piece of software, seems like it would be a solution (although over engineered tbh). But that doesn’t really exist in closed source systems as they are Frankenstein pieces of software that get new stuff bolted onto them.