Skip to content
SLSA

in-toto attestation framework

Referencereferences/in-toto-attestation

Nobody has checked this yet

still a draft

Written 2026-10-30 by ktl-librarian (automation).

The full record
Checks
none recorded
Sources
Related to
Pointed to by
Graph
Open this concept in the knowledge graph
IRI
https://w3id.org/lmodel/slsa/knowledge/references/in-toto-attestation
Licence
CC BY 4.0
Files
MarkdownJSON-LDSource on GitHubHistory on GitHub

in-toto attestation framework

Section titled “in-toto attestation framework”

The in-toto attestation framework defines the layers of a software attestation. Its Statement page says that the Statement is the middle layer of an attestation: it binds the attestation to its subjects and names the type of its predicate.1 A ResourceDescriptor describes one software artifact or other resource, and a DigestSet maps algorithm names to the digests of one artifact.

The SLSA specification copy links these pages at commit 7aefca35a0f74a6e0cb397a8c4a76558f54de571 of the in-toto/attestation repository, for example in verification_summary.md.2

The schema’s copy

Section titled “The schema’s copy”

NOTICE says that src/slsa/schema/in_toto/in_toto_core.yaml is the core module of the in-toto Attestation Framework’s LinkML schema from lmodel/in-toto at v0.1.0, under the Apache License 2.0, copied unchanged.34 tests/test_in_toto_import.py pins the copy to that file by its git object hash, 3ffd841743df241e2948a2150caa8b03a024762f.5

The module links the framework’s pages at in-toto/attestation’s tag v1.2.0, not at the commit the SLSA copy links. Its classes and their keys take in-toto’s IRIs, under https://w3id.org/lmodel/in-toto/, except media_type, which is dcat:mediaType, and algorithm, which is spdx:algorithm.6

The module holds seven classes:

  • InTotoStatement: the statement, whose statement_type is always https://in-toto.io/Statement/v1.
  • InTotoStatementSubject: one subject of a statement, which must carry a digest, as the Statement page requires.1
  • InTotoResourceDescriptor: a descriptor that carries at least one of a URI, a digest or its content, as the ResourceDescriptor page requires.7
  • InTotoDigestSet: the digests of one artifact. It names the 19 hash algorithms the DigestSet page lists, dirHash and the four git object types.8
  • InTotoAdditionalDigest: one digest under an algorithm the digest set does not name, such as a source control system’s own revision type.
  • InTotoAnnotation: one annotation on a descriptor.
  • InTotoPredicate: the abstract base of every predicate a statement can carry, whose predicate_kind names the concrete kind.

It also holds three field types. in_toto_resource_uri and in_toto_type_uri are URIs with their scheme and authority in lowercase, and in_toto_timestamp is a time in RFC 3339 format in UTC, written with a trailing Z.6

The DigestSet page says that a consumer must accept only the algorithms it considers secure and ignore the rest, and that most applications should not accept md5.

slsa LinkML schema says how the schema imports the module and what it builds on it.

Footnotes

Section titled “Footnotes”

  1. https://github.com/in-toto/attestation/blob/7aefca35a0f74a6e0cb397a8c4a76558f54de571/spec/v1/statement.md, the opening and subject ↩ ↩2

  2. src/slsa/schema/spec/verification_summary.md, its in-toto links ↩

  3. NOTICE, the lmodel/in-toto section ↩

  4. https://github.com/lmodel/in-toto/releases/tag/v0.1.0, the release ↩

  5. tests/test_in_toto_import.py, PINNED_BLOB ↩

  6. src/slsa/schema/in_toto/in_toto_core.yaml, see_also, slot_uri and types ↩ ↩2

  7. https://github.com/in-toto/attestation/blob/7aefca35a0f74a6e0cb397a8c4a76558f54de571/spec/v1/resource_descriptor.md, Fields ↩

  8. https://github.com/in-toto/attestation/blob/7aefca35a0f74a6e0cb397a8c4a76558f54de571/spec/v1/digest_set.md, the algorithms and the consumer guidelines ↩