in-toto

Open source

Open source framework for protecting software supply chain integrity through attestations.

Pricing: free
License: open-source
Open source: Yes

Editorial review

in-toto has not yet been editorially reviewed. User reviews and published field data below are unaffected — we say so rather than implying an editorial verdict.

Facts & attributes

Every value carries its evidence state. “—” means unknown — never a silent default (P-02).

Identity · Taxonomy

Tags(open-source;cloud-native): supply chain security, software attestation, build integrity, CNCFVerification pending

Pricing · Licensing

License model(proprietary;open-source;source-available;dual-license): open-sourceVerification pending
Pricing model(free;subscription;usage;seat;asset;transaction;revenue-share;perpetual;custom): freeVerification pending
Source repository(HTTPS URL): https://github.com/in-toto/in-totoVerified
SPDX license IDs(Apache-2.0;MIT): Apache-2.0Verification pending

Features · Product · Fit

Core capabilities(authoring;automation;analytics): Secure the integrity of a software product from initiation to end-user installation, Open, extensible metadata standard for software supply chains, Transparency into what steps were performed, by whom and in what order, Apache-licensed libraries and tools, Adoptions and integrations ecosystemVerification pending

Audience · Use · Case

Best for(Neutral editorial summary): Supply chain security teams attesting that software build and delivery steps ran as planned, by authorized personnel onlyVerification pending
Primary use cases(build;monitor;automate): Software supply chain integrity, Build and delivery step verificationVerification pending

Lifecycle · Versioning

Maintenance status(active;maintenance;deprecated;EOL;archived): activeVerification pending

Also categorized in

Secure Software Supply Chain Attestation Tools (SLSA/Provenance)

User reviews

Review policy

No published reviews yet.