in-toto

github.com ↗

Framework for supply chain attestations; underpins SLSA and cosign provenance.