in-toto secured builds by making every step leave signed evidence

Software update systems can prove that the last package was signed, but they may be protecting an artifact already compromised earlier. in-toto targeted that gap: source, test, build, package and release steps can all become attack points.

Its elegant choice was to make the supply chain itself auditable. The project's documentation says it shows what steps were performed, by whom and in what order, so users can verify whether each step was intended and performed by the right actor.

CNCF accepted in-toto on August 14, 2019, moved it to Incubating on March 10, 2022, and to Graduated on February 10, 2025. That path turned an academic supply-chain idea into cloud-native infrastructure.

Turn the pipeline into signed receipts

Signed step metadata let verification cover the path to the artifact, not only the artifact.

The model was open and extensible, so different build systems could implement it without sharing one pipeline.

Ordering mattered: a valid actor doing a step at the wrong time could be detected.

CNCF governance gave adopters a neutral place to standardize integrations.

A provenance standard is more useful when it describes the process, not just the final package.

in-toto became a graduated CNCF project and a common attestation layer for supply-chain tooling. Its idea now appears in ecosystems that need build provenance, policy checks and tamper-evident evidence across many tools.