[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFE213C2F3ZGCPBWCEMW12":3,"skill-same:01M6AFE213C2F3ZGCPBWCEMW12":126},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":67,"commitSha":68,"skillDirectory":69,"forksCount":70,"repositoryHtmlUrl":71,"repositoryHomepageUrl":72,"ownerHtmlUrl":73,"ownerBlogUrl":74,"ownerDescription":75,"updatedAt":76,"install":77,"resources":90},"01M6AFE213C2F3ZGCPBWCEMW12","implementing-supply-chain-security-with-in-toto",null,"Implements supply chain integrity verification for container builds with the in-toto framework: generating signing keys, defining a supply chain layout, recording pipeline steps as signed link metadata, verifying before deployment, enforcing at Kubernetes admission, and integrating with SLSA. Use when attesting CI\u002FCD pipeline steps, proving an image followed the approved build process, or enforcing provenance at admission. Keywords: in-toto, layout, link metadata, step, inspection, SLSA, provenance, admission. Do not use for signing and verifying images with Cosign - use implementing-image-provenance-verification-with-cosign.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-supply-chain-security-with-in-toto\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"security","implementing supply chain security with in toto","supply chain security","supply-chain","image","in-toto","cncf","integrity","attestation","t1195","supply-chain-security","pipeline","cybersecurity","SBOM","container-security","ci","framework","verification","deployment","pr","2026-11-10 10:12:30",false,"---\nname: implementing-supply-chain-security-with-in-toto\ndescription: >-\n  Implements supply chain integrity verification for container builds with the in-toto\n  framework: generating signing keys, defining a supply chain layout, recording pipeline steps\n  as signed link metadata, verifying before deployment, enforcing at Kubernetes admission, and\n  integrating with SLSA. Use when attesting CI\u002FCD pipeline steps, proving an image followed\n  the approved build process, or enforcing provenance at admission. Keywords: in-toto, layout,\n  link metadata, step, inspection, SLSA, provenance, admission. Do not use for signing and\n  verifying images with Cosign - use implementing-image-provenance-verification-with-cosign.\ndomain: cybersecurity\nsubdomain: container-security\ntags:\n- in-toto\n- supply-chain-security\n- attestation\n- slsa\n- sigstore\n- container-security\n- cncf\n- provenance\n- sbom\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- PR.IR-01\n- ID.AM-08\n- DE.CM-01\nmitre_attack:\n- T1610\n- T1611\n- T1609\n- T1525\n- T1195\n---\n\n# Implementing Supply Chain Security with in-toto\n\n## Overview\n\nin-toto is a CNCF graduated project that ensures the integrity of software supply chains from initiation to end-user installation. It creates a verifiable record of the entire software development lifecycle by generating cryptographically signed attestations (called \"link metadata\") at each step, proving what happened, who performed it, and what artifacts were produced. For container environments, in-toto verifies that images deployed to Kubernetes followed approved build processes and have not been tampered with.\n\n\n## When to Use\n\n- When deploying or configuring implementing supply chain security with in toto capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Python 3.8+ or Go runtime for in-toto client libraries\n- GPG or Ed25519 keys for signing attestations\n- Container build pipeline (Docker, Buildah, or Kaniko)\n- Container registry (Docker Hub, ECR, GCR, or Harbor)\n- Kubernetes cluster for deployment verification\n\n## Core Concepts\n\n### Supply Chain Layout\n\nThe layout is the central policy document that defines:\n\n- **Steps**: Ordered operations in the supply chain (clone, build, test, package, push)\n- **Functionaries**: Authorized entities (people or CI systems) that perform each step\n- **Inspections**: Client-side verification checks performed at verification time\n- **Expected artifacts**: Input\u002Foutput relationships between steps\n\n```python\nfrom in_toto.models.layout import Layout, Step, Inspection\nfrom securesystemslib.interface import import_ed25519_privatekey_from_file\n\n# Create the supply chain layout\nlayout = Layout()\nlayout.set_relative_expiration(months=3)\n\n# Define the code clone step\nstep_clone = Step(name=\"clone\")\nstep_clone.expected_materials = []\nstep_clone.expected_products = [[\"CREATE\", \"src\u002F*\"]]\nstep_clone.pubkeys = [clone_functionary_keyid]\nstep_clone.expected_command = [\"git\", \"clone\"]\nstep_clone.threshold = 1\n\n# Define the build step\nstep_build = Step(name=\"build\")\nstep_build.expected_materials = [[\"MATCH\", \"src\u002F*\", \"WITH\", \"PRODUCTS\", \"FROM\", \"clone\"]]\nstep_build.expected_products = [[\"CREATE\", \"image.tar\"]]\nstep_build.pubkeys = [build_functionary_keyid]\nstep_build.expected_command = [\"docker\", \"build\"]\nstep_build.threshold = 1\n\n# Define the scan step\nstep_scan = Step(name=\"scan\")\nstep_scan.expected_materials = [[\"MATCH\", \"image.tar\", \"WITH\", \"PRODUCTS\", \"FROM\", \"build\"]]\nstep_scan.expected_products = [[\"CREATE\", \"scan-report.json\"]]\nstep_scan.pubkeys = [scan_functionary_keyid]\nstep_scan.threshold = 1\n\nlayout.steps = [step_clone, step_build, step_scan]\n```\n\n### Link Metadata\n\nEach step execution generates a link file containing:\n\n- Materials consumed (input artifacts with hashes)\n- Products created (output artifacts with hashes)\n- Command executed\n- Cryptographic signature of the functionary\n\n### Verification Process\n\nAt deployment time, the verifier checks:\n1. All required steps were performed\n2. Each step was signed by an authorized functionary\n3. Artifact hashes chain correctly between steps\n4. No unauthorized modifications occurred between steps\n\n## Implementation\n\n### Step 1: Generate Signing Keys\n\n```bash\n# Generate Ed25519 key pairs for each functionary\nmkdir -p keys\n\n# Project owner key (signs the layout)\nin-toto-keygen --type ed25519 keys\u002Fowner\n\n# CI builder key\nin-toto-keygen --type ed25519 keys\u002Fbuilder\n\n# Security scanner key\nin-toto-keygen --type ed25519 keys\u002Fscanner\n```\n\n### Step 2: Create the Supply Chain Layout\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Generate in-toto supply chain layout for container builds.\"\"\"\n\nfrom in_toto.models.layout import Layout, Step, Inspection\nfrom in_toto.models.metadata import Envelope\nfrom securesystemslib.signer import CryptoSigner\nfrom securesystemslib.interface import import_ed25519_publickey_from_file\n\ndef create_container_build_layout():\n    layout = Layout()\n    layout.set_relative_expiration(months=6)\n\n    # Load functionary public keys\n    builder_key = import_ed25519_publickey_from_file(\"keys\u002Fbuilder.pub\")\n    scanner_key = import_ed25519_publickey_from_file(\"keys\u002Fscanner.pub\")\n\n    layout.keys = {\n        builder_key[\"keyid\"]: builder_key,\n        scanner_key[\"keyid\"]: scanner_key,\n    }\n\n    # Step 1: Source code checkout\n    checkout = Step(name=\"checkout\")\n    checkout.expected_materials = []\n    checkout.expected_products = [\n        [\"CREATE\", \"Dockerfile\"],\n        [\"CREATE\", \"src\u002F*\"],\n        [\"CREATE\", \"requirements.txt\"],\n    ]\n    checkout.pubkeys = [builder_key[\"keyid\"]]\n    checkout.threshold = 1\n\n    # Step 2: Build container image\n    build = Step(name=\"build\")\n    build.expected_materials = [\n        [\"MATCH\", \"Dockerfile\", \"WITH\", \"PRODUCTS\", \"FROM\", \"checkout\"],\n        [\"MATCH\", \"src\u002F*\", \"WITH\", \"PRODUCTS\", \"FROM\", \"checkout\"],\n    ]\n    build.expected_products = [[\"CREATE\", \"image-digest.txt\"]]\n    build.pubkeys = [builder_key[\"keyid\"]]\n    build.threshold = 1\n\n    # Step 3: Security scan\n    scan = Step(name=\"scan\")\n    scan.expected_materials = [\n        [\"MATCH\", \"image-digest.txt\", \"WITH\", \"PRODUCTS\", \"FROM\", \"build\"]\n    ]\n    scan.expected_products = [\n        [\"CREATE\", \"vulnerability-report.json\"],\n        [\"CREATE\", \"sbom.json\"],\n    ]\n    scan.pubkeys = [scanner_key[\"keyid\"]]\n    scan.threshold = 1\n\n    # Inspection: Verify no critical vulnerabilities\n    inspect_vulns = Inspection(name=\"verify-no-critical-vulns\")\n    inspect_vulns.expected_materials = [\n        [\"MATCH\", \"vulnerability-report.json\", \"WITH\", \"PRODUCTS\", \"FROM\", \"scan\"]\n    ]\n    inspect_vulns.run = [\n        \"python\", \"-c\",\n        \"import json,sys; r=json.load(open('vulnerability-report.json')); \"\n        \"sys.exit(1) if any(v['severity']=='CRITICAL' for v in r.get('vulnerabilities',[])) else sys.exit(0)\"\n    ]\n\n    layout.steps = [checkout, build, scan]\n    layout.inspect = [inspect_vulns]\n\n    return layout\n\nif __name__ == \"__main__\":\n    layout = create_container_build_layout()\n    # Sign with owner key and save\n    owner_signer = CryptoSigner.from_priv_key_uri(\"file:keys\u002Fowner\")\n    envelope = Envelope.from_signable(layout)\n    envelope.create_signature(owner_signer)\n    envelope.dump(\"root.layout\")\n    print(\"Layout created and signed: root.layout\")\n```\n\n### Step 3: Record Pipeline Steps\n\n```bash\n# In CI\u002FCD pipeline - record each step\n\n# Step 1: Checkout\nin-toto-run --step-name checkout \\\n  --key keys\u002Fbuilder \\\n  --products Dockerfile src\u002F* requirements.txt \\\n  -- git clone https:\u002F\u002Fgithub.com\u002Forg\u002Fapp.git .\n\n# Step 2: Build\nin-toto-run --step-name build \\\n  --key keys\u002Fbuilder \\\n  --materials Dockerfile src\u002F* \\\n  --products image-digest.txt \\\n  -- bash -c \"docker build -t app:latest . && docker inspect --format='{{.Id}}' app:latest > image-digest.txt\"\n\n# Step 3: Scan\nin-toto-run --step-name scan \\\n  --key keys\u002Fscanner \\\n  --materials image-digest.txt \\\n  --products vulnerability-report.json sbom.json \\\n  -- bash -c \"trivy image --format json app:latest > vulnerability-report.json && syft app:latest -o json > sbom.json\"\n```\n\n### Step 4: Verify Before Deployment\n\n```bash\n# Verify the entire supply chain\nin-toto-verify --layout root.layout \\\n  --layout-key keys\u002Fowner.pub \\\n  --link-dir .\u002Flink-metadata\u002F\n\n# If verification passes, proceed with deployment\nif [ $? -eq 0 ]; then\n  kubectl apply -f deployment.yaml\n  echo \"Supply chain verification passed - deploying\"\nelse\n  echo \"SUPPLY CHAIN VERIFICATION FAILED - blocking deployment\"\n  exit 1\nfi\n```\n\n### Step 5: Kubernetes Admission Control\n\nIntegrate with a policy engine to verify attestations at admission:\n\n```yaml\napiVersion: admissionregistration.k8s.io\u002Fv1\nkind: ValidatingWebhookConfiguration\nmetadata:\n  name: in-toto-verifier\nwebhooks:\n  - name: verify.in-toto.io\n    rules:\n      - apiGroups: [\"apps\"]\n        resources: [\"deployments\"]\n        operations: [\"CREATE\", \"UPDATE\"]\n    clientConfig:\n      service:\n        name: in-toto-webhook\n        namespace: security\n        path: \u002Fverify\n    failurePolicy: Fail\n    sideEffects: None\n    admissionReviewVersions: [\"v1\"]\n```\n\n## SLSA Integration\n\nin-toto attestations map directly to SLSA (Supply chain Levels for Software Artifacts) requirements:\n\n| SLSA Level | in-toto Requirement |\n|------------|-------------------|\n| Level 1 | Build process documented (layout exists) |\n| Level 2 | Signed attestations from hosted build service |\n| Level 3 | Hardened build platform, non-falsifiable provenance |\n| Level 4 | Two-party review, hermetic builds |\n\n## References\n\n- [in-toto Official Website](https:\u002F\u002Fin-toto.io\u002F)\n- [in-toto GitHub Repository](https:\u002F\u002Fgithub.com\u002Fin-toto\u002Fin-toto)\n- [CNCF in-toto Graduation Announcement](https:\u002F\u002Fwww.cncf.io\u002Fannouncements\u002F2025\u002F04\u002F23\u002Fcncf-announces-graduation-of-in-toto-security-framework-enhancing-software-supply-chain-integrity-across-industries\u002F)\n- [SLSA Framework](https:\u002F\u002Fslsa.dev\u002F)\n- [Sigstore Integration](https:\u002F\u002Fwww.sigstore.dev\u002F)\n","# Implementing Supply Chain Security with in-toto\n\n## Overview\n\nin-toto is a CNCF graduated project that ensures the integrity of software supply chains from initiation to end-user installation. It creates a verifiable record of the entire software development lifecycle by generating cryptographically signed attestations (called \"link metadata\") at each step, proving what happened, who performed it, and what artifacts were produced. For container environments, in-toto verifies that images deployed to Kubernetes followed approved build processes and have not been tampered with.\n\n\n## When to Use\n\n- When deploying or configuring implementing supply chain security with in toto capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Python 3.8+ or Go runtime for in-toto client libraries\n- GPG or Ed25519 keys for signing attestations\n- Container build pipeline (Docker, Buildah, or Kaniko)\n- Container registry (Docker Hub, ECR, GCR, or Harbor)\n- Kubernetes cluster for deployment verification\n\n## Core Concepts\n\n### Supply Chain Layout\n\nThe layout is the central policy document that defines:\n\n- **Steps**: Ordered operations in the supply chain (clone, build, test, package, push)\n- **Functionaries**: Authorized entities (people or CI systems) that perform each step\n- **Inspections**: Client-side verification checks performed at verification time\n- **Expected artifacts**: Input\u002Foutput relationships between steps\n\n```python\nfrom in_toto.models.layout import Layout, Step, Inspection\nfrom securesystemslib.interface import import_ed25519_privatekey_from_file\n\n# Create the supply chain layout\nlayout = Layout()\nlayout.set_relative_expiration(months=3)\n\n# Define the code clone step\nstep_clone = Step(name=\"clone\")\nstep_clone.expected_materials = []\nstep_clone.expected_products = [[\"CREATE\", \"src\u002F*\"]]\nstep_clone.pubkeys = [clone_functionary_keyid]\nstep_clone.expected_command = [\"git\", \"clone\"]\nstep_clone.threshold = 1\n\n# Define the build step\nstep_build = Step(name=\"build\")\nstep_build.expected_materials = [[\"MATCH\", \"src\u002F*\", \"WITH\", \"PRODUCTS\", \"FROM\", \"clone\"]]\nstep_build.expected_products = [[\"CREATE\", \"image.tar\"]]\nstep_build.pubkeys = [build_functionary_keyid]\nstep_build.expected_command = [\"docker\", \"build\"]\nstep_build.threshold = 1\n\n# Define the scan step\nstep_scan = Step(name=\"scan\")\nstep_scan.expected_materials = [[\"MATCH\", \"image.tar\", \"WITH\", \"PRODUCTS\", \"FROM\", \"build\"]]\nstep_scan.expected_products = [[\"CREATE\", \"scan-report.json\"]]\nstep_scan.pubkeys = [scan_functionary_keyid]\nstep_scan.threshold = 1\n\nlayout.steps = [step_clone, step_build, step_scan]\n```\n\n### Link Metadata\n\nEach step execution generates a link file containing:\n\n- Materials consumed (input artifacts with hashes)\n- Products created (output artifacts with hashes)\n- Command executed\n- Cryptographic signature of the functionary\n\n### Verification Process\n\nAt deployment time, the verifier checks:\n1. All required steps were performed\n2. Each step was signed by an authorized functionary\n3. Artifact hashes chain correctly between steps\n4. No unauthorized modifications occurred between steps\n\n## Implementation\n\n### Step 1: Generate Signing Keys\n\n```bash\n# Generate Ed25519 key pairs for each functionary\nmkdir -p keys\n\n# Project owner key (signs the layout)\nin-toto-keygen --type ed25519 keys\u002Fowner\n\n# CI builder key\nin-toto-keygen --type ed25519 keys\u002Fbuilder\n\n# Security scanner key\nin-toto-keygen --type ed25519 keys\u002Fscanner\n```\n\n### Step 2: Create the Supply Chain Layout\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Generate in-toto supply chain layout for container builds.\"\"\"\n\nfrom in_toto.models.layout import Layout, Step, Inspection\nfrom in_toto.models.metadata import Envelope\nfrom securesystemslib.signer import CryptoSigner\nfrom securesystemslib.interface import import_ed25519_publickey_from_file\n\ndef create_container_build_layout():\n    layout = Layout()\n    layout.set_relative_expiration(months=6)\n\n    # Load functionary public keys\n    builder_key = import_ed25519_publickey_from_file(\"keys\u002Fbuilder.pub\")\n    scanner_key = import_ed25519_publickey_from_file(\"keys\u002Fscanner.pub\")\n\n    layout.keys = {\n        builder_key[\"keyid\"]: builder_key,\n        scanner_key[\"keyid\"]: scanner_key,\n    }\n\n    # Step 1: Source code checkout\n    checkout = Step(name=\"checkout\")\n    checkout.expected_materials = []\n    checkout.expected_products = [\n        [\"CREATE\", \"Dockerfile\"],\n        [\"CREATE\", \"src\u002F*\"],\n        [\"CREATE\", \"requirements.txt\"],\n    ]\n    checkout.pubkeys = [builder_key[\"keyid\"]]\n    checkout.threshold = 1\n\n    # Step 2: Build container image\n    build = Step(name=\"build\")\n    build.expected_materials = [\n        [\"MATCH\", \"Dockerfile\", \"WITH\", \"PRODUCTS\", \"FROM\", \"checkout\"],\n        [\"MATCH\", \"src\u002F*\", \"WITH\", \"PRODUCTS\", \"FROM\", \"checkout\"],\n    ]\n    build.expected_products = [[\"CREATE\", \"image-digest.txt\"]]\n    build.pubkeys = [builder_key[\"keyid\"]]\n    build.threshold = 1\n\n    # Step 3: Security scan\n    scan = Step(name=\"scan\")\n    scan.expected_materials = [\n        [\"MATCH\", \"image-digest.txt\", \"WITH\", \"PRODUCTS\", \"FROM\", \"build\"]\n    ]\n    scan.expected_products = [\n        [\"CREATE\", \"vulnerability-report.json\"],\n        [\"CREATE\", \"sbom.json\"],\n    ]\n    scan.pubkeys = [scanner_key[\"keyid\"]]\n    scan.threshold = 1\n\n    # Inspection: Verify no critical vulnerabilities\n    inspect_vulns = Inspection(name=\"verify-no-critical-vulns\")\n    inspect_vulns.expected_materials = [\n        [\"MATCH\", \"vulnerability-report.json\", \"WITH\", \"PRODUCTS\", \"FROM\", \"scan\"]\n    ]\n    inspect_vulns.run = [\n        \"python\", \"-c\",\n        \"import json,sys; r=json.load(open('vulnerability-report.json')); \"\n        \"sys.exit(1) if any(v['severity']=='CRITICAL' for v in r.get('vulnerabilities',[])) else sys.exit(0)\"\n    ]\n\n    layout.steps = [checkout, build, scan]\n    layout.inspect = [inspect_vulns]\n\n    return layout\n\nif __name__ == \"__main__\":\n    layout = create_container_build_layout()\n    # Sign with owner key and save\n    owner_signer = CryptoSigner.from_priv_key_uri(\"file:keys\u002Fowner\")\n    envelope = Envelope.from_signable(layout)\n    envelope.create_signature(owner_signer)\n    envelope.dump(\"root.layout\")\n    print(\"Layout created and signed: root.layout\")\n```\n\n### Step 3: Record Pipeline Steps\n\n```bash\n# In CI\u002FCD pipeline - record each step\n\n# Step 1: Checkout\nin-toto-run --step-name checkout \\\n  --key keys\u002Fbuilder \\\n  --products Dockerfile src\u002F* requirements.txt \\\n  -- git clone https:\u002F\u002Fgithub.com\u002Forg\u002Fapp.git .\n\n# Step 2: Build\nin-toto-run --step-name build \\\n  --key keys\u002Fbuilder \\\n  --materials Dockerfile src\u002F* \\\n  --products image-digest.txt \\\n  -- bash -c \"docker build -t app:latest . && docker inspect --format='{{.Id}}' app:latest > image-digest.txt\"\n\n# Step 3: Scan\nin-toto-run --step-name scan \\\n  --key keys\u002Fscanner \\\n  --materials image-digest.txt \\\n  --products vulnerability-report.json sbom.json \\\n  -- bash -c \"trivy image --format json app:latest > vulnerability-report.json && syft app:latest -o json > sbom.json\"\n```\n\n### Step 4: Verify Before Deployment\n\n```bash\n# Verify the entire supply chain\nin-toto-verify --layout root.layout \\\n  --layout-key keys\u002Fowner.pub \\\n  --link-dir .\u002Flink-metadata\u002F\n\n# If verification passes, proceed with deployment\nif [ $? -eq 0 ]; then\n  kubectl apply -f deployment.yaml\n  echo \"Supply chain verification passed - deploying\"\nelse\n  echo \"SUPPLY CHAIN VERIFICATION FAILED - blocking deployment\"\n  exit 1\nfi\n```\n\n### Step 5: Kubernetes Admission Control\n\nIntegrate with a policy engine to verify attestations at admission:\n\n```yaml\napiVersion: admissionregistration.k8s.io\u002Fv1\nkind: ValidatingWebhookConfiguration\nmetadata:\n  name: in-toto-verifier\nwebhooks:\n  - name: verify.in-toto.io\n    rules:\n      - apiGroups: [\"apps\"]\n        resources: [\"deployments\"]\n        operations: [\"CREATE\", \"UPDATE\"]\n    clientConfig:\n      service:\n        name: in-toto-webhook\n        namespace: security\n        path: \u002Fverify\n    failurePolicy: Fail\n    sideEffects: None\n    admissionReviewVersions: [\"v1\"]\n```\n\n## SLSA Integration\n\nin-toto attestations map directly to SLSA (Supply chain Levels for Software Artifacts) requirements:\n\n| SLSA Level | in-toto Requirement |\n|------------|-------------------|\n| Level 1 | Build process documented (layout exists) |\n| Level 2 | Signed attestations from hosted build service |\n| Level 3 | Hardened build platform, non-falsifiable provenance |\n| Level 4 | Two-party review, hermetic builds |\n\n## References\n\n- [in-toto Official Website](https:\u002F\u002Fin-toto.io\u002F)\n- [in-toto GitHub Repository](https:\u002F\u002Fgithub.com\u002Fin-toto\u002Fin-toto)\n- [CNCF in-toto Graduation Announcement](https:\u002F\u002Fwww.cncf.io\u002Fannouncements\u002F2025\u002F04\u002F23\u002Fcncf-announces-graduation-of-in-toto-security-framework-enhancing-software-supply-chain-integrity-across-industries\u002F)\n- [SLSA Framework](https:\u002F\u002Fslsa.dev\u002F)\n- [Sigstore Integration](https:\u002F\u002Fwww.sigstore.dev\u002F)\n",{"name":5,"tags":49,"author":54,"domain":36,"license":15,"version":55,"nist_csf":56,"subdomain":38,"description":7,"mitre_attack":61},[29,34,32,50,51,38,30,52,53],"slsa","sigstore","provenance","sbom","mahipal","1.0",[57,58,59,60],"PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01",[62,63,64,65,66],"T1610","T1611","T1609","T1525","T1195","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-supply-chain-security-with-in-toto",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":78,"prompt":88,"zipAvailable":89},[79,82,85],{"tool":80,"command":81},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-supply-chain-security-with-in-toto",{"tool":83,"command":84},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-supply-chain-security-with-in-toto",{"tool":86,"command":87},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-supply-chain-security-with-in-toto","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-supply-chain-security-with-in-toto\u002FSKILL.md",true,[91,97,102,108,112,116,122],{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"assets\u002Ftemplate.md","ASSET","资产文件",1356,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-supply-chain-security-with-in-toto\u002Fassets\u002Ftemplate.md",{"path":98,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-supply-chain-security-with-in-toto\u002FLICENSE",{"path":103,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":106,"sourceHtmlUrl":107},"references\u002Fapi-reference.md","REFERENCE","参考文档",4813,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-supply-chain-security-with-in-toto\u002Freferences\u002Fapi-reference.md",{"path":109,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":110,"sourceHtmlUrl":111},"references\u002Fstandards.md",2200,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-supply-chain-security-with-in-toto\u002Freferences\u002Fstandards.md",{"path":113,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":114,"sourceHtmlUrl":115},"references\u002Fworkflows.md",2826,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-supply-chain-security-with-in-toto\u002Freferences\u002Fworkflows.md",{"path":117,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":120,"sourceHtmlUrl":121},"scripts\u002Fagent.py","SCRIPT","脚本",9843,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-supply-chain-security-with-in-toto\u002Fscripts\u002Fagent.py",{"path":123,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":124,"sourceHtmlUrl":125},"scripts\u002Fprocess.py",10034,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-supply-chain-security-with-in-toto\u002Fscripts\u002Fprocess.py",[127,145,167,195,221,247],{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":136,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[133],{"categoryNo":134,"categoryName":135,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[51,52,50,137,24,36,138,139,43,140,141,39,27,35,34,33,32,142,143,144],"verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","code-signing","cosign","keyless",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":152,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[151],{"categoryNo":134,"categoryName":135,"taxonomyType":21,"taxonomyTypeDesc":22},[153,32,154,155,24,156,36,43,41,157,158,159,160,161,31,162,163,164,165,166],"boot","TPM","validating tpm measured boot attestation","policy","ZeRO","firmware","Tools","measured-boot","PCR","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":177,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[173,176],{"categoryNo":174,"categoryName":175,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":134,"categoryName":135,"taxonomyType":21,"taxonomyTypeDesc":22},[31,178,179,180,181,36,182,183,41,184,185,186,187,188,189,190,191,192,193,194],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":202,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[201],{"categoryNo":134,"categoryName":135,"taxonomyType":21,"taxonomyTypeDesc":22},[203,204,205,36,206,207,208,209,210,211,212,213,214,215,216,217,159,218,219,220],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":222,"name":223,"nameZh":6,"description":224,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":225,"categories":226,"keywords":228,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[227],{"categoryNo":134,"categoryName":135,"taxonomyType":21,"taxonomyTypeDesc":22},[229,40,230,36,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246],"vulnerabilities","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":248,"name":249,"nameZh":6,"description":250,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":251,"categories":252,"keywords":254,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[253],{"categoryNo":134,"categoryName":135,"taxonomyType":21,"taxonomyTypeDesc":22},[24,255,36,256,257,258,259,260,261,262,263,190,264,191,265,266,267,268,269,270],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]