Welcome to the in-toto documentation!

in-toto is a framework for software supply chain security. This documentation covers the in-toto Python reference implementation of the in-toto specification. More information about in-toto can be found at in-toto.io.

• Installation
  • On Debian
  • On Arch Linux
  • Using PIP
  • Installing from Source
  • Installing for Development
• Command Line Tools
  • Evidence Generation
  • Supply Chain Verification
  • Utilities
• API
  • Evidence Generation
  • Supply Chain Verification
  • Key Utilities
• Metadata Model
  • Metadata
  • DSSE Envelope
  • Metablock
  • Link
  • Layout
  • Step
  • Inspection
• Configuration
  • Settings
  • Artifact Exclude Patterns
• Layout Creation Example
• Demo Supply Chain