in-toto
An open-source software supply chain security specification and framework used to describe each step in a software build process and its associated attestations. It ensures the integrity and verifiability of the entire supply chain and is widely adopted by tools such as cosign.
Timeline (last 90 days)
cosign's Attestation feature allows arbitrary structured metadata (such as scan reports, SBOMs, and build logs) to be attached to an artifact in signed form, following the in-toto Attestation Framework format.
SLSA's Provenance format is built on the in-toto Attestation specification, and the two are not mutually exclusive.
All Facts (2)
cosign's Attestation feature allows arbitrary structured metadata (such as scan reports, SBOMs, and build logs) to be attached to an artifact in signed form, following the in-toto Attestation Framework format.
50%UnverifiedSLSA's Provenance format is built on the in-toto Attestation specification, and the two are not mutually exclusive.
50%