{"id":13721654,"url":"https://github.com/in-toto/attestation","last_synced_at":"2025-05-15T01:06:47.119Z","repository":{"id":38309658,"uuid":"353735795","full_name":"in-toto/attestation","owner":"in-toto","description":"in-toto Attestation Framework","archived":false,"fork":false,"pushed_at":"2025-03-31T15:30:27.000Z","size":2092,"stargazers_count":266,"open_issues_count":62,"forks_count":74,"subscribers_count":21,"default_branch":"main","last_synced_at":"2025-04-10T10:09:50.695Z","etag":null,"topics":["attestation","software-supply-chain-security"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/in-toto.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":null,"support":null,"governance":"GOVERNANCE.md","roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-04-01T14:58:27.000Z","updated_at":"2025-04-09T18:02:55.000Z","dependencies_parsed_at":"2023-10-14T09:25:06.808Z","dependency_job_id":"3cc79d85-cc82-4828-bf90-a8e403a0790e","html_url":"https://github.com/in-toto/attestation","commit_stats":null,"previous_names":[],"tags_count":6,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/in-toto%2Fattestation","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/in-toto%2Fattestation/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/in-toto%2Fattestation/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/in-toto%2Fattestation/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/in-toto","download_url":"https://codeload.github.com/in-toto/attestation/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254254041,"owners_count":22039792,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["attestation","software-supply-chain-security"],"created_at":"2024-08-03T01:01:19.833Z","updated_at":"2025-05-15T01:06:42.106Z","avatar_url":"https://github.com/in-toto.png","language":"Go","funding_links":[],"categories":["Rust","Security"],"sub_categories":["Software Supply Chain Security"],"readme":"# in-toto Attestation Framework\n\nThe in-toto Attestation Framework provides a specification for generating\nverifiable claims about any aspect of how a piece of software is produced.\nConsumers or users of software can then validate the origins of the software,\nand establish trust in its supply chain, using in-toto attestations.\n\n## Learning about in-toto attestations\n\nTo get started, check out the [overview] of the in-toto Attestation Framework.\n\nFor a deeper dive, we recommend reading through our [documentation] to learn\nmore about the goals of the in-toto Attestation Framework. If you encountered\nin-toto via the SLSA project, take a look at this\n[blog post](https://slsa.dev/blog/2023/05/in-toto-and-slsa) to understand how\nthe two frameworks intersect and how you can use in-toto for SLSA.\n\nVisit [https://in-toto.io](https://in-toto.io) to learn about the larger\nin-toto project.\n\n## Working with in-toto attestations\n\nThe core of the in-toto Attestation Framework is the [specification] that\ndefines the format for in-toto attestations and the metadata they contain.\n\nWe also provide a set of [attestation predicates], which are metadata\nformats vetted by our maintainers to cover a number of common use cases.\n\nFor tooling integration, we provide [protobuf definitions] of the spec.\nWe currently only provide language bindings for Go and Python.\n\n## Is your use case not covered by existing predicate types?\n\nTake a look at the open [issues] or [pull requests] to see if your usage has\nalready been reported. We can help with use cases, thinking through options,\nand questions about existing predicates. Feel free to comment on an existing\nissue or PR.\n\n## Want to propose a new predicate type?\n\nIf you still can't find what you're looking for, open a new issue or\npull request. Before opening a request for a new metadata format, please\nreview our [New Predicate Guidelines].\n\n## Governance\n\nThe in-toto Attestation Framework is part of the [in-toto] project under the\n[CNCF]. For more information, see [GOVERNANCE.md].\n\nUse `@in-toto/attestation-maintainers` to tag the maintainers on GitHub.\n\n## Insights and Activities\n\nStay up-to-date with the latest activities and discussions in the in-toto Attestation Framework by exploring the [maintainers' notes](https://hackmd.io/fRKbxm6MT3GEz-_oSQtmYA).\n\n## Disclaimer\n\nThe in-toto Attestation Framework is still under development. We are in the\nprocess of developing tooling to enable better integration and adoption of\nthe framework. In the meantime, please visit any of the language-specific\n[in-toto implementations] to become familiar with current tooling options.\n\n[CNCF]: https://www.cncf.io/projects/in-toto/\n[GOVERNANCE.md]: GOVERNANCE.md\n[New Predicate Guidelines]: docs/new_predicate_guidelines.md\n[attestation predicates]: spec/predicates/\n[documentation]: docs/\n[in-toto]: https://in-toto.io\n[in-toto implementations]: https://github.com/in-toto\n[issues]: https://github.com/in-toto/attestation/issues?q=is%3Aopen+is%3Aissue\n[overview]: spec/README.md#in-toto-attestation-framework-spec\n[protobuf definitions]: protos/\n[pull requests]: https://github.com/in-toto/attestation/pulls?q=is%3Aopen+is%3Apr\n[specification]: spec/v1/\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fin-toto%2Fattestation","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fin-toto%2Fattestation","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fin-toto%2Fattestation/lists"}