DOCS / STANDARDS / IN-TOTO
in-toto
A framework for securing the integrity of a software supply chain — defining how to record and verify each step from source to deployment.
Key concepts
- Statement
- The unsigned claim: a subject, a predicate type, and predicate data.
- Predicate
- The type-specific payload describing what happened.
- Attestation Framework
- ITE-6 — the specification defining how Statements are structured and exchanged.
Where CDK fits
Every CDK attestation is a valid in-toto Statement — "_type": "https://in-toto.io/Statement/v1" — with CDK-defined predicate types for approvals, deployments, and policy evaluations. See the Evidence Model Specification for the exact schema CDK implements.