in-toto supply chain verification

[mattyn]

As discussed in Standardized Metadata, in-toto is an existing effort to standardize some toolchain metadata. In particular, it provides a standardized way for supply chain owners to define steps and verification instructions so that steps can be performed by various functionaries and their results can be verified independently by the supply chain owner and the consumer of the supply chain products.

I'm starting this thread to gather ideas and reactions from the interoperability group about this standard and how it can contribute to CI/CD tool interoperability.

[fdegir]

Just an update - I had a chat with Santiago and he kindly accepted to join to our next SIG meeting on November 18th, 16:00UTC.