in-toto is a framework and specification for cryptographically verifying the integrity of a software supply chain. It captures and attests each step of the build and release process so the final product can be verified end to end.