in-toto Provenance Verification

Metadata contract

Include the following metadata in each image object when calling /api/v1/ingest/registry-images:

{
  "require_in_toto": true,
  "in_toto_layout_path": "root.layout",
  "in_toto_key_paths": ["layout.pub"],
  "in_toto_link_dir": "."
}

Outcome mapping

• Verified provenance: keeps baseline registry finding classification.
• Missing in-toto inputs: escalates to attestation_missing.
• Verification failure: escalates to supply_chain_integrity.
• Verification status is written into source.extra.in_toto_verification.

Rollout guidance

• Start by enabling in a staging connector instance first.
• Use deterministic layout and key paths in connector containers.
• Pair with Kyverno signed-image enforcement for full preventive coverage.