in-toto

Provenance Framework: supply chain layout, artifact identity (PURL/CPE), artifact hashes.


Region	International
Country or scope	International
Sector	Supply Chain
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers in-toto

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 6 controls from Safeguard's control catalog for in-toto.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for in-toto and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`INTOTO-LAYOUT` Supply Chain Layout	The supply chain must be described as an explicit layout of steps and the artifacts flowing between them, i.e. documented dependency relationships (in-toto Specification v1.0, layout definition)	Scan
`INTOTO-HASH` Artifact Hash Recording	Link metadata must record cryptographic hashes of every material and product so artifacts can be verified end to end (in-toto Specification v1.0, link metadata)	Scan
`INTOTO-ARTIFACT-ID` Unambiguous Artifact Identity	Artifact rules match artifacts by unambiguous identity, so each component must be identifiable via PURL or CPE (in-toto Specification v1.0, artifact rules)	Scan
`INTOTO-FUNCTIONARY` Functionary Provenance	Every step is performed by an identified, key-holding functionary, so the tool or party that produced the metadata must be recorded (in-toto Specification v1.0, functionary keys)	Scan
`INTOTO-STEP-OWNER` Step Ownership Attribution	The party responsible for producing each artifact in the chain must be attributable, mapping to named suppliers for components (in-toto Specification v1.0, step authorization)	Scan
`INTOTO-FORMAT` Machine-Verifiable Metadata	Supply chain metadata must be machine-readable and verifiable, satisfied by a standard SBOM format such as SPDX or CycloneDX (in-toto Specification v1.0, metadata format)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`INTOTO-LAYOUT-1`	Define and Sign an in-toto Supply Chain Layout
`INTOTO-LAYOUT-2`	Authorize Functionaries for Each Supply Chain Step
`INTOTO-STEP-1`	Generate Signed Link Metadata for Every Build Step
`INTOTO-ARTIFACT-1`	Verify Artifact Integrity Across Pipeline Stages
`INTOTO-VERIFY-1`	Perform Full Supply Chain Verification at Deployment
`INTOTO-KEY-1`	Protect in-toto Signing Keys in Secure Storage

Policy templates

Written for in-toto:

in-toto Supply Chain Security Policy
in-toto Key and Layout Management Policy

And 22 from the standard set, adapted to in-toto.