{"id":23883,"library":"in-toto-attestation","title":"in-toto-attestation","description":"Python bindings for the in-toto Attestation Framework. This library provides models and serialization for creating, verifying, and bundling software attestations according to the in-toto specification (v1.0+). Current version is 0.9.3 on PyPI, but the library is under active development with GitHub releases up to v1.2.0. The PyPI package lags behind the specification releases; users should prefer the latest GitHub release for up-to-date functionality.","status":"active","version":"0.9.3","language":"python","source_language":"en","source_url":"https://github.com/in-toto/attestation","tags":["in-toto","attestation","supply-chain","security","provenance","slsa"],"install":[{"cmd":"pip install in-toto-attestation","lang":"bash","label":"pip install"},{"cmd":"pip install git+https://github.com/in-toto/attestation.git@v1.2.0","lang":"bash","label":"install from GitHub"}],"dependencies":[],"imports":[{"wrong":"from in_toto_attestation.v1 import Statement","symbol":"Statement","correct":"from in_toto_attestation import Statement"}],"quickstart":{"code":"from in_toto_attestation.v1 import Statement\nfrom in_toto_attestation.v1.attestation import Attestation\nfrom in_toto_attestation.v1.resource_descriptor import ResourceDescriptor\nimport json\n\nsub = ResourceDescriptor(name='example', digest={'sha256': 'abc123'})\nstmt = Statement(subject=[sub], predicate_type='https://example.com/predicate/v1')\nprint(json.dumps(stmt.to_dict(), indent=2))","lang":"python","description":"Create a simple in-toto Statement and serialize it to JSON."},"warnings":[{"fix":"Install from GitHub: pip install git+https://github.com/in-toto/attestation.git@v1.2.0","message":"PyPI package (0.9.3) is outdated and does not include v1.1+ features like the Bundle type or newer predicate types. Always check if the GitHub release is newer and install from source if needed.","severity":"gotcha","affected_versions":"<=0.9.3"},{"fix":"Use from in_toto_attestation.v1 import Statement (and other classes).","message":"In v1.0.0, the API changed significantly from older 0.x versions. The whole module structure moved under in_toto_attestation.v1. Old imports from in_toto_attestation directly will break.","severity":"breaking","affected_versions":">=1.0.0"},{"fix":"Update DigestSet usage to accept non-cryptographic digests if needed.","message":"The 'DigestSet' field type is now generalized to 'DigestSet' supporting any immutable identifier (not just cryptographic). Existing code using DigestSet with only cryptographic digests remains compatible but may need to update validation logic.","severity":"deprecated","affected_versions":"<1.1.0"},{"fix":"Use stmt.to_dict() then json.dumps(...).","message":"Serialization to JSON uses to_dict() method, not .json() or .serialize(). Always call to_dict() before json.dumps().","severity":"gotcha","affected_versions":">=0.9.3"}],"env_vars":null,"search_vec":"'0.9.3':38 'accord':27 'activ':46 'attest':4,12,26,78 'behind':58 'bind':6 'bundl':24 'chain':81 'creat':21 'current':35 'date':73 'develop':47 'framework':13 'function':74 'github':49,67 'in-toto':9,30,75 'in-toto-attest':1 'lag':57 'latest':66 'librari':15,43 'model':17 'packag':56 'prefer':64 'proven':83 'provid':16 'pypi':40,55 'python':5 'releas':50,61,68 'secur':82 'serial':19 'slsa':84 'softwar':25 'specif':33,60 'suppli':80 'supply-chain':79 'toto':3,11,32,77 'up-to-d':70 'user':62 'v1.0':34 'v1.2.0':53 'verifi':22 'version':36","created_at":"2026-05-01T08:10:08.083537+00:00","updated_at":"2026-05-01T08:10:08.083537+00:00","problems":{"verify_error":"Traceback (most recent call last):\n  File \"<string>\", line 1, in <module>\nImportError: cannot import name 'Statement' from 'in_toto_attestation' (/tmp/tmp73ok54e9/venv/lib/python3.12/site-packages/in_toto_attestation/__init__.py)"},"ecosystem":"pypi","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":"0.9.3","cli_name":"","cli_version":null,"type":"library","homepage":"https://in-toto.io","github":"https://github.com/in-toto/attestation","docs":null,"changelog":null,"pypi":"https://pypi.org/project/in-toto-attestation/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["auth-security","serialization","data"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"import_fail","verified_at":"2026-07-03","last_verified":"2026-07-03","next_check":"2026-07-10","install_tag":null}}