In-toto: A framework to secure the integrity of software supply chains
Summary
in-toto is a framework designed to secure the integrity of software supply chains by making the steps, actors, and order transparent to users. It presents an open metadata standard, ecosystem integrations, and tooling, and is a CNCF-graduated open-source project. The page positions in-toto as a comprehensive solution for end-to-end software provenance and supply chain governance.