- I thought this was a good explainer on what In-toto is, when to use it, and how it's different from e.g. Sigstore:
https://nesbitt.io/2026/05/24/signing-is-for-the-bad-days.ht...
by mrbluecoat
3 subcomments
- Feels way too over-engineered
https://github.com/in-toto/specification/blob/v1.0/in-toto-s...
by fathermarz
0 subcomment
- The issue with software supply chain is that you have to be in step the entire chain and developers are creative. I don’t have to pull in a dependency when I can copy paste code out of third party repos or stack overflow.
Also this doesn’t take into consideration one of the ugliest sides of SSC which is M&A. Sure on a completely greenfield piece of software, seems like it would be a solution (although over engineered tbh). But that doesn’t really exist in closed source systems as they are Frankenstein pieces of software that get new stuff bolted onto them.
by _superposition_
0 subcomment
- I've wondered with all the generated code, will llm provenance be a thing in the future? I can't imagine the DoD/DoW wants qwen writing its code.
by RickJWagner
0 subcomment
- Supply chain security is not easy, but it’s an important defense. Red Hat has done some good work in this area.
by Chris2048
3 subcomments
- Looking at the Debian example: https://in-toto.io/docs/examples/debian/
Does Debian already provide signature on .deb files (that is, provide a manifest of their hashes and and sign each)? If so, you could potentially d/l the files from any source/mirror?
- [flagged]
Hacker News