Notes from 2/24 in-toto community meeting

Skip to first unread message

Lois A DeLong

Mar 17, 2020, 12:31:26 PM3/17/20
to in-toto-public

Discussion Summary from the in-toto Community Meeting

February 24, 2020

Note: We had some issues during our meeting with faulty acoustics and, as a result, these notes are not as complete as we would like them to be. We apologize for any discussion threads that were inadvertently omitted, or any incorrect statements. Please feel free to help us “fill in the gaps” by sharing on the thread.  We will come up with a more reliable technology for our next meeting. 

Meeting participants

Santiago Torres-Arias, Moderator

Gerard Borst, Mynor Cifuentes, Reza Curtmola, Marc Evers, Tobias Furuholm, Jim Gettys, Juan Gomez, Jack Kelly, Jon Knox, Bart Kors, Trishank Kuppusamy, Adam Lewis, Joshua Lock, Andrew Martin, Radu Matei, Lukas Pühringer, Brian Russell, Jennie Steshenko, Aditya Sirish A Yelgundhalli


Below is a brief summary of the topics discussed in the meeting.



Santiago brought the group up to date on progress towards in-toto V. 1.0.0, which is scheduled for completion in April 2020. This included work on cross-implementation interoperability for in-toto golang and work with Debian to test the reproducibility of packages. The current progress report on the Roadmap can be found at, and


Lukas talked about the remaining tasks for the v1.0.0 release of the reference implementation, which boil down to setting in stone a stable API and generating library documentation. 



Gerard Borst and Bart Kors from Rabobank, who have created a fork of in-toto called Argos Supply Chain Notary, described their ongoing progress with the system. This included a change to the layout and link metadata format with the goal of making it more JSON compatible, the addition of an expected final product field in the layout, and the removal of inspections.



Aditya talked briefly about his work on ITE 4, which allows generic URI schemes to refer to abstract entities in in-toto metadata, such as GitHub PRs (see  He invited everyone to review and comment on the PR, which is relevant for collaborations with SPDX (Source Package Data Exchange) and GitHub.


in-toto jenkins plugin

Aditya also mentioned preparing a demo that uses the in-toto Jenkins plugin to publish attestations for the steps of a web app build pipeline in a Grafeas store, performing final product verification in an in-toto Kubernetes admission controller 

(Note: Parts of that demo have been presented by Mark Russinovich, CTO of Microsoft Azure, at RSA Conference


Other Issues


  • There was some discussion about moving to a different meeting technology as this Zoom technology had issues, particularly with accessibility and background noise.

  • Lukas and Justin will attend KubeCon and each is scheduled to do a talk. 

(Note: KubeCon Europe was postponed to July/August due to COVID-19)

  • There was a general consensus that posting on the in-toto mailing list might be the best way to initiate discussions of concern to the community. These discussions could then be moved to GitHub in the form of issues or pull requests as warranted.


Please note that we have set up a Google Doc at

to collect agenda items for our next community meeting. We invite everyone to post any issues you'd like to discuss here.

Respectfully Submitted,

Lois Anne DeLong

NYU Tandon/in-toto



Reply all
Reply to author
0 new messages