in-toto is a framework to protect supply chain integrity. - View it on GitHub