Contributor
Qijia “Joy” Liu

Develop in-toto-rs (Rust) for integration with rebuilderd


Mentors
Aditya Sirish, Santiago Torres Arias
Organization
CNCF

Description: rebuilderd is a verification system for binary packages. It repeats the build process of a package in an identical environment and verifies that the package is identical. It is part of the Reproducible Builds effort and can currently be used to rebuild Arch Linux packages. The rebuild must optionally generate in-toto link attestations which can be used to verify the entire process. To that end, the nascent in-toto-rs library must be developed to enable this integration with rebuilderd.