Package: in-toto (1.3.1-1) software supply chain security framework Other Packages Related to in-toto: [python3-pkg-resources ]
Package Discovery and Resource Access using pkg_resources
[python3-cryptography ]
Python library exposing cryptographic recipes and primitives (Python 3)
[python3-nacl ]
Python bindings to libsodium (Python 3)
[python3-attr ]
Attributes without boilerplate (Python 3)
[python3-dateutil ]
powerful extensions to the standard Python 3 datetime module
[python3-iso8601 ]
Python module to parse ISO 8601 dates - Python 3.x
[python3-pathspec ]
utility library for gitignore style pattern matching of file paths (Python 3)
[python3-securesystemslib ] (>= 0.26.0)
crypto and schema library for TUF and in-toto
[python3 ] [any]
interactive high-level object-oriented language (default python3 version)
Package file paths (0) Paths come from the repository package-file index for the observed builds. They describe archive/package associations, not every file that will exist on a running system after maintainer scripts, alternatives, generated state, diversions, or installation choices.
No package-associated file paths were observed for the displayed build metadata.
Field source: Debian 12 (Bookworm) main amd64
Use this package OpenFactory can boot this operating system in a browser VM, or start a build that includes the native package name from this record.
Versions, suites, and repositories Each row is recorded package-index metadata for one version, architecture, suite, and repository. Names, URLs, and sizes are source-reported; a link is a potentially mutable retrieval location, not an OpenFactory redistribution claim or proof that OpenFactory retained the artifact bytes.
Known vulnerabilities Matching against OpenFactory catalog package versions is in progress.
CVE Severity Version impact [CVE-2023-32076 ] Published: May 10, 2023, 6:15:10 PM UTC
in-toto: CVE-2023-32076
Medium(5.5) Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 28, 2026, 5:46:38 PM UTC
Details (2)
Last synced: Oct 29, 2026, 4:27:16 AM UTC
[CVE catalog ]
Checksums Repository signatures authenticate metadata. Artifact hashing is recorded separately. Neither establishes package safety.
1.3.1-1 / all Observed Sep 1, 2026 sha256 4a25076743c2…5dabc11cSource-reported digest Metadata observed; artifact bytes were not independently fetched or hashed by this catalog import. The digest below is source-reported.
Source-reported digest (sha256): 4a25076743c2d6d7ac44361d6b1f36f94de86f805c9ef99b59fed1d75dabc11c
Verify download
printf '%s %s\n' '4a25076743c2d6d7ac44361d6b1f36f94de86f805c9ef99b59fed1d75dabc11c' 'in-toto_1.3.1-1_all.deb' | sha256sum --check --strict -Field source: Debian 12 (Bookworm) main amd64
1.3.1-1 / all Observed Sep 1, 2026 sha256 4a25076743c2…5dabc11cSource-reported digest Metadata observed; artifact bytes were not independently fetched or hashed by this catalog import. The digest below is source-reported.
Source-reported digest (sha256): 4a25076743c2d6d7ac44361d6b1f36f94de86f805c9ef99b59fed1d75dabc11c
Verify download
printf '%s %s\n' '4a25076743c2d6d7ac44361d6b1f36f94de86f805c9ef99b59fed1d75dabc11c' 'in-toto_1.3.1-1_all.deb' | sha256sum --check --strict -Field source: Debian 12 (Bookworm) main arm64
