diff --git a/content/en/ecosystem/adopters/index.md b/content/en/ecosystem/adopters/index.md index 28f885d..37ee213 100644 --- a/content/en/ecosystem/adopters/index.md +++ b/content/en/ecosystem/adopters/index.md @@ -7,7 +7,7 @@ This section lists organizations or individuals who have adopted the project and | Organization | | Description | |---------------|------|-------------| -| Datadog ||Datadog uses in-toto to secure its agent integrations as they move through the company's CI/CD system. | -| OpenVEX ||OpenVEX documents are designed to be self-sustaining, but the specification is designed to benefit from the in-toto attestation format completing VEX statements with data outside of the OpenVEX predicate. | -| SLSA ||Supply chain Levels for Software Artifacts, or SLSA, is a framework that provides a series of requirements and controls. | -| SolarWinds ||SolarWinds is an American company that provides information technology services and software to other companies and government agencies. | \ No newline at end of file +| Datadog ||Datadog uses in-toto to secure its agent integrations as they move through the company's CI/CD system. | +| OpenVEX ||OpenVEX documents are designed to be self-sustaining, but the specification is designed to benefit from the in-toto attestation format completing VEX statements with data outside of the OpenVEX predicate. | +| SLSA ||Supply chain Levels for Software Artifacts, or SLSA, is a framework that provides a series of requirements and controls. | +| SolarWinds ||SolarWinds is an American company that provides information technology services and software to other companies and government agencies. | \ No newline at end of file diff --git a/content/en/ecosystem/integreations/index.md b/content/en/ecosystem/integreations/index.md index f2952f2..1526aee 100644 --- a/content/en/ecosystem/integreations/index.md +++ b/content/en/ecosystem/integreations/index.md @@ -7,12 +7,12 @@ This section lists software systems, services, or platforms that integrate with | Organization | | Description | |------------------|------|-------------| -| GitLab | | GitLab is a popular Git server that also provides CI/CD integrations. | -| Grafeas || Grafeas is an open source metadata API that is used to store metadata relevant to software supply chains. Grafeas includes support for in-toto link metadata. | -| GUAC || GUAC has the ability to ingest and parse SLSA and other in-toto ITE6 attestations (either wrapped in DSSE or standalone). | +| GitLab | | GitLab is a popular Git server that also provides CI/CD integrations. | +| Grafeas || Grafeas is an open source metadata API that is used to store metadata relevant to software supply chains. Grafeas includes support for in-toto link metadata. | +| GUAC || GUAC has the ability to ingest and parse SLSA and other in-toto ITE6 attestations (either wrapped in DSSE or standalone). | | Hoppr || Hoppr leverages the in-toto python package to generate in-toto layout files based on a hoppr transfer configuration. | -| Jenkins || The in-toto team maintains a plugin for Jenkins that can be used to generate in-toto metadata pertaining to a particular build or "job". | +| Jenkins || The in-toto team maintains a plugin for Jenkins that can be used to generate in-toto metadata pertaining to a particular build or "job". | | rebuilderd || Rebuilderd is a build system project part of Reproducible Builds. When the result of a rebuild is positive, i.e., the build process is found to be reproducible, rebuilderd generates an in-toto link recording this result. | -| Sigstore || In-toto and Sigstore are complementary in their efforts, and Sigstore integrates in-toto in a number of ways. Sigstore's keyless signing can be used to sign in-toto metadata, as demonstrated by Cosign's SLSA Provenance generation. | -| Tekton Chains | | Tekton Chains is a component for Tekton that adds software supply chain security. Chains observes all "TaskRuns" or jobs that are executed, and generates an in-toto attestation. | -| TestifySec || TestifySec is a software supply chain security company that has created two open source projects that leverage in-toto. Witness and Archivista. | \ No newline at end of file +| Sigstore || In-toto and Sigstore are complementary in their efforts, and Sigstore integrates in-toto in a number of ways. Sigstore's keyless signing can be used to sign in-toto metadata, as demonstrated by Cosign's SLSA Provenance generation. | +| Tekton Chains | | Tekton Chains is a component for Tekton that adds software supply chain security. Chains observes all "TaskRuns" or jobs that are executed, and generates an in-toto attestation. | +| TestifySec || TestifySec is a software supply chain security company that has created two open source projects that leverage in-toto. Witness and Archivista. | \ No newline at end of file