in-toto

A framework to protect software supply chain integrity