In-toto: A framework to secure the integrity of software supply chains

In-toto is a CNCF graduated framework that provides end-to-end visibility and integrity verification across the software supply chain by creating transparent, auditable records of every step, actor, and order of operations in development and deployment processes. This open standard addresses critical supply chain security risks by enabling organizations to detect unauthorized changes, verify authenticity, and ensure compliance from code initiation through end-user installation. For IT organizations, adopting in-toto reduces vulnerability to supply chain attacks, enhances security posture, and provides the transparency necessary for regulatory compliance and incident investigation.