in-toto

Term 2 · Jun-Aug · 3 projects

• Add GUAC support

  LFX Mentorship · Listed in the official cohort

  @SantiagoTorresSource IssueLFX portal

  The project aims to integrate Graph for Understanding Artifact Composition (GUAC) with in-toto, a framework safeguarding software supply chain integrity. Graph for Understanding Artifact Composition (GUAC) aggregates software security metadata into a high fidelity graph database—normalizing entity identities and mapping standard relationships between them. This project seeks to extend in-toto's capabilities by incorporating GUAC, enabling users to query GUAC with Package URLs (purls) and retrieve pertinent attestations.

  • Go
  • Python

• Documentation Boost!

  LFX Mentorship · Listed in the official cohort

  @JustinCapposSource IssueLFX portal

  Help contributors get started with improving the documentation of CNCF projects and TAGs. To start, we'd like mentees to help to improve both the documentation of a project, and also encourage them to contribute to other projects. So, view the issues as a starting point to help start your career in open source.

  • Technical writing
  • Basic understanding of cloud native projects (or a desire to learn!)

• Sigstore support for in-toto-jenkins

  LFX Mentorship · Listed in the official cohort

  @SantiagoTorresSource IssueLFX portal

  The in-toto Jenkins plugin allows users to generate metadata in their build pipelines. Currently keys or credentials must be provided to the plugin to sign the metadata, whereas Sigstore offers keyless signing and verification. The addition of Sigstore transport will allow seamless uploading of metadata to Rekor transparency log. This project aims to enhance the Jenkins plugin by adding Sigstore support, allowing keyless signing and adding Sigstore transport.

  • Java
  • Jenkins