Glossary

in-toto

A framework for securing software supply chains with signed metadata about each step (who performed it, on which inputs and producing which outputs), so a verifier can check that the steps of a defined layout were followed. Its attestation format underlies SLSA provenance.

Defined in: in-toto

Covered in

Guide

Read SLSA provenance and verify the claim you need

Connect an artifact to its build evidence while distinguishing provenance, build assurance and source controls.

Practice: Local project: Build and verify a signed software release