In-toto: A framework to secure the integrity of software supply chains

1 comments

• Chris2048 13 minutes ago
  Looking at the Debian example: https://in-toto.io/docs/examples/debian/

  Does Debian already provide signature on .deb files (that is, provide a manifest of their hashes and and sign each)? If so, you could potentially d/l the files from any source/mirror?