in‑toto Attestations

"in‑toto Attestations: End‑to‑End Supply Chain Integrity for Artifacts"
Modern software delivery pipelines are hostile environments, even when your registries, CI, and access controls look “secure.” This book is for experienced security engineers, platform teams, and tool builders who need cryptographically verifiable, artifact-centric integrity—proof that the artifact you deploy is the one you intended, with evidence you can audit, automate, and enforce across organizations and toolchains.
You’ll master the in-toto Attestation Framework from the spec level up: how statements bind claims to immutable subjects via digests; how predicateType contracts make evidence interoperable and enforceable; and how DSSE signing provides byte-level guarantees that survive serialization pitfalls. From there, the book moves into distribution realities—OCI referrers, digest-first workflows, and portable bundles—before applying everything to high-value predicates such as SLSA Provenance v1, attested SBOMs (SPDX/CycloneDX), and verification summaries that scale evidence-to-decision chaining. Finally, it shows how to design verification policies, integrate admission control, choose trust-root models (pinned keys, PKI, keyless), and run attestations as an operational security system with monitoring, drift detection, and incident playbooks.
Readers should be comfortable with cryptographic signatures, container/OCI concepts, and CI/CD architecture. The emphasis is on precise semantics, failure modes, and rollout trade-offs—so you can build controls that are both correct and survivable in produc