in-toto
A Go implementation of the in-toto framework for protecting software supply chain integrity through cryptographic verification.
What is in-toto?
in-toto-golang is a Go implementation of the in-toto framework designed to protect software supply chain integrity. It provides cryptographic verification of each step in the software production process, ensuring that no unauthorized modifications occur between source code and deployment. The implementation focuses on verification for admission controllers and kubectl plugins.
Developers and security engineers building secure software supply chains, particularly those working with Kubernetes admission controllers or needing SPIFFE/SPIRE integration for identity management.
This implementation offers a production-ready, auditable core focused on verification rather than broad feature coverage, making it reliable for critical security applications. Its integration with SPIFFE/SPIRE through X.509 signing provides enhanced identity verification capabilities.
Overview
A Go implementation of in-toto. in-toto is a framework to protect software supply chain integrity.
Use Cases
Best For
- Verifying software supply chain integrity in Kubernetes environments
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
