in-toto is a framework designed to protect the integrity of software supply chains. Rather than concentrating solely on the final package or binary, it records evidence about the individual steps used to produce software and later verifies that those steps were carried out according to a predefined plan. This can help detect unauthorised changes introduced during building, testing, packaging or other stages of a release process.
The framework centres on a signed layout created by the project owner. This layout describes the expected supply-chain steps, identifies the functionaries authorised to carry them out, and specifies rules governing the materials consumed and products generated by each step. When a functionary performs a step, in-toto can generate signed link metadata recording the command and relevant artifacts. These links collectively provide evidence of what happened as software moved through the supply chain.
Artifact rules give project owners considerable control over what each stage is permitted or required to do. Rules can specify that files must be created, deleted, modified or present, while MATCH rules can connect the output of one stage with the input of another. Inspections can also be defined in the layout and executed during verification. This allows in-toto to check much more than a cryptographic signature on the final file. It can determine whether the sequence of operations that produced that file corresponds to the process approved by the project owner.
This is free and open source software.
Key Features
- Defines expected software supply chains using signed layouts.
- Specifies the functionaries authorised to perform individual steps.
- Records signed link metadata describing completed supply-chain operations.
- Tracks materials consumed and products generated by each step.
- Provides rules governing creation, deletion and modification of artifacts.
- Chains artifacts between successive supply-chain steps with MATCH rules.
- Supports inspections that run as part of the verification process.
- Checks layout signatures, expiration and authorised functionaries.
- Verifies that required commands and artifact rules were followed.
- Provides tools for recording, signing and verifying supply-chain metadata.
Website: github.com/in-toto/in-toto
Support:
Developer: New York University: Secure Systems Lab
License: Apache License 2.0
in-toto is written in Python. Learn Python with our recommended free books and free tutorials.
 Explore our carefully curated directory of recommended free and open source software, covering every major software category.The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form. |
Please read our Comment Policy before commenting.