The safeguards map / 3.7 Admission and owner settings
in-toto
Drafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
A framework and command-line tools that record who performed each software supply chain step and verify the result against an owner-signed layout.
Where it sits
3.7 Admission and owner settings (primary): Verifies a final product against a signed layout of authorized steps and functionaries, with signed link metadata from each step as evidence.
Use in-toto-verify on the final product to verify that the layout was signed with the project owner’s private key(s)
captured
The layout, signed by the project owners, together with the links, signed by the designated functionaries, are released as part of the final product
captured
Facts
- Concern
- security
- Names the law
- no
- Subject
- software
- Used by
- those who make itthose who distribute itthose who run it
- Runs
- by handin CI
- Policy comes from
- owner-entered settings
Handoffs
produces Provenance and signatures: in-toto link metadata and signed layouts
consumes Provenance and signatures: in-toto link metadata and signed layouts
Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.