Define and verify an in-toto software supply chain layout with materials and products
domain: in-toto.io · 6 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Define a layout file that names each functionary (step owner), specifies expected materials and products for each step, and sets inspection rules
Sign the layout with the project owner key and distribute the public key to verifiers
Instrument each pipeline step to produce a signed link metadata file recording actual materials consumed and products generated
Collect all link files at the end of the pipeline
Run in-toto verify with the layout and the collected link files to confirm the supply chain executed as declared
Fail the release if verification exits non-zero or if any inspection rule is violated
Known gotchas
Materials and products are matched by file path hash; any path normalization difference between the step runner and the layout definition causes verification failure
Threshold settings on steps allow multiple functionaries to sign; setting threshold too low weakens the guarantee and too high may block legitimate pipelines
Link metadata files must be kept immutable after signing; any post-hoc modification invalidates the signature and breaks verification
Give your agent this knowledge — and 15,600+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?