In-Toto

aid: in-toto
name: In-Toto
description: in-toto is a CNCF graduated framework for securing the integrity of software supply chains. It provides a specification
  for generating and verifying metadata about each step in a software supply chain, from source code to deployment. in-toto
  ensures that each step is performed by the authorized party and that materials and products are not tampered with between
  steps.
url: https://in-toto.io
accessModel:
  pricing: freemium
  onboarding: unknown
  trial: false
  try_now: false
  public: false
  label: Freemium
  confidence: medium
  source:
  - plans
  generated: '2026-07-22'
  method: derived
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/icons/in-toto.png
tags:
- Cloud Native
- Graduated
- Security
- Software Integrity
- Supply Chain Security
- Verification
created: '2026-03-16'
modified: '2026-04-28'
specificationVersion: '0.19'
type: Index
apis:
- aid: in-toto:in-toto-spec
  name: in-toto Attestation Specification
  description: The in-toto specification defines the metadata format for recording software supply chain steps. It includes
    layout metadata that defines the expected steps and their authorized functionaries, and link metadata that records what
    actually happened at each step including materials consumed and products produced. Verification compares layouts against
    links to detect tampering.
  humanURL: https://in-toto.io/docs/specs/
  image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/apis-json-logo.jpg
  properties:
  - type: Documentation
    url: https://in-toto.io/docs/specs/
  - type: Reference
    url: https://github.com/in-toto/docs/blob/master/in-toto-spec.md
  - type: JSONSchema
    url: json-schema/in-toto-layout-schema.json
  - type: JSONSchema
    url: json-schema/in-toto-link-schema.json
  - type: JSONSchema
    url: json-schema/in-toto-attestation-schema.json
  - type: JSONLD
    url: json-ld/in-toto-context.jsonld
  tags:
  - Attestation
  - Specification
  - Supply Chain
- aid: in-toto:in-toto-attestation-framework
  name: in-toto Attestation Framework
  description: The in-toto Attestation Framework provides a specification for generating verifiable claims about any aspect
    of how a piece of software is produced. It defines a fixed lightweight Statement structure with a subject and predicate,
    and a set of standard predicate types covering common use cases such as SLSA provenance. A future version of the in-toto
    specification will incorporate this framework as the primary mechanism to express supply chain claims.
  humanURL: https://github.com/in-toto/attestation
  image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/apis-json-logo.jpg
  properties:
  - type: Documentation
    url: https://github.com/in-toto/attestation/blob/main/README.md
  - type: Reference
    url: https://github.com/in-toto/attestation/tree/main/spec/v1
  - type: GitHubRepository
    url: https://github.com/in-toto/attestation
  - type: JSONSchema
    url: json-schema/in-toto-attestation-schema.json
  - type: JSONLD
    url: json-ld/in-toto-context.jsonld
  tags:
  - Attestation
  - SLSA
  - Specification
  - Supply Chain
- aid: in-toto:in-toto-python
  name: in-toto Python Reference Implementation
  description: The Python reference implementation of in-toto provides tools and libraries for creating and verifying in-toto
    metadata. It includes the in-toto-run command for wrapping supply chain steps, in-toto-record for multi-command steps,
    and in-toto-verify for checking the full supply chain layout. This implementation serves as the canonical reference for
    the specification.
  humanURL: https://github.com/in-toto/in-toto
  image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/apis-json-logo.jpg
  properties:
  - type: Documentation
    url: https://in-toto.readthedocs.io/
  - type: GettingStarted
    url: https://in-toto.io/docs/getting-started/
  - type: GitHubRepository
    url: https://github.com/in-toto/in-toto
  tags:
  - Python
  - Reference Implementation
  - SDK
  - Supply Chain
- aid: in-toto:in-toto-golang
  name: in-toto Go Implementation
  description: A Go implementation of the in-toto specification that enables supply chain integrity verification in Go-based
    build and deployment pipelines. It provides the same core functionality as the Python reference implementation including
    generating link metadata, creating layouts, and verifying supply chains. It supports ITE-7 for X.509-based signing via
    SPIFFE/SPIRE integration.
  humanURL: https://github.com/in-toto/in-toto-golang
  image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/apis-json-logo.jpg
  properties:
  - type: Documentation
    url: https://pkg.go.dev/github.com/in-toto/in-toto-golang
  - type: GitHubRepository
    url: https://github.com/in-toto/in-toto-golang
  tags:
  - Go
  - Implementation
  - SDK
  - Supply Chain
common:
- type: DomainSecurity
  url: security/in-toto-domain-security.yml
- type: Website
  url: https://in-toto.io
- type: Documentation
  url: https://in-toto.io/docs/
- type: GettingStarted
  url: https://in-toto.io/docs/getting-started/
- type: Blog
  url: https://in-toto.io/blog/
- type: Community
  url: https://in-toto.io/community/
- type: FAQ
  url: https://in-toto.io/docs/faq/
- type: GitHubOrganization
  url: https://github.com/in-toto
- type: JSONSchema
  url: json-schema/in-toto-layout-schema.json
- type: JSONSchema
  url: json-schema/in-toto-link-schema.json
- type: JSONSchema
  url: json-schema/in-toto-attestation-schema.json
- type: JSONLD
  url: json-ld/in-toto-context.jsonld
- type: Rules
  url: rules/in-toto-rules.yml
- type: Integrations
  url: https://in-toto.io/ecosystem/
integrations:
- name: Adopters
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com