in-toto for Go
Radar: Initial
Apache-2.0
The Go implementation of in-toto, used by supply-chain tooling written in Go.
in-toto
Specifications it implements
What this tool does to each specification, in the role vocabulary. Follow a standard through to standards.apievangelist.com for what it actually specifies.
| Standard | Role | What that means |
|---|---|---|
| in-toto | attests |
Using this from an agent
- Interfaces
library- Install
-
go
github.com/in-toto/in-toto-golang - Emits
- in-toto-attestation
- Runtime
- Runs offline Deterministic Read-only Needs credentials
Where it applies
Jobs this tool actually does, and the surface each one is exercised on.
Generate or verify attestations from a Go supply-chain tool.
coding-agent
- Website
- https://in-toto.io/
- Repository
- https://github.com/in-toto/in-toto-golang
- License
- Apache-2.0 — read from the repository's LICENSE file, verified 2026-09-17
- Stars
- 151 · last commit 2026-09-10
Reading this as an agent? Don't scrape the page — this entry is published as
structured data at
arrow_back
All tools by adoption
/tools.json,
against the tool.schema.json
schema, using the roles.json
vocabulary. Start at /llms.txt.