Software Supply Chain · security identity · CNCF, OpenSSF-aligned

in-toto

in-toto is a framework and specification for cryptographically verifying the integrity of a software supply chain. It captures and attests each step of the build and release process so the final product can be verified end to end.

in-toto.io/The standard

CNCF, OpenSSF-alignedGoverning body · Linux Foundation

2018First published

StableCurrent version

Yes — Protocol BuffersMachine-readable schema · open

0providers in the catalog

Also known as in-toto.

Providers that carry in-toto 0

No provider in the catalog carries this standard as a tag yet. That is a statement about the catalog's tagging, not about adoption: a provider that implements in-toto and says so in its APIs.json profile appears here on the next build. Add or correct a listing.

Read from the API Evangelist standards directory, facts verified 2026-08-17. Provider links come from the catalog's own identity tags and are rebuilt nightly. If this page is wrong about a standard or a provider, say so.