in-toto
A framework and format for signed statements about how software was produced, such as build provenance.
In more detail
Each step of a supply chain can record a signed attestation saying what went in, what came out and who ran it. SLSA provenance is usually written as an in-toto attestation. Verifiers check the signatures and the claims before trusting an artifact.
Related terms
- SLSA — A security framework that defines levels of assurance for how software is built, from basic build records to hardened, verified builds.
- software supply chain — Everything that goes into your software before it runs: base images, packages, build tools, CI systems and registries.
Taught in
- Which Benchmark, And Who Checked It? Compliance And Frameworks — Kubernetes and Cloud Native Security Associate (KCSA) Exam Prep