# in-toto Security Audit Response

Source: https://www.testifysec.com/blog/in-toto-sec-audit-response/

Author: TestifySec Team

Published: 2023-08-23

Updated: 2026-10-06

Our response to the in-toto security audit findings and improvements.

Editorial update · October 6, 2026

Updated to distinguish the 2023 audit from Witness, separate proposed work from shipped features, correct an advisory reference, and explain why signing identity does not prove producer integrity. The original URL and publication date are retained.

- [Current TestifySec docs →](https://www.testifysec.com/docs)
- [Trust architecture →](https://www.testifysec.com/docs/cilock/trust)

The 2023 in-toto security audit examined the Python and Go implementations and the specification. Witness was not directly audited. This response records how TestifySec considered the findings for Witness; it is not an independent audit of Witness or a statement that every proposed mitigation shipped.

 

## What the audit found

 

X41 D-Sec conducted the review, coordinated by OSTIF with CNCF funding. The [audit announcement and report](https://ostif.org/our-audit-of-in-toto-is-complete/) describe eight security findings: one high, four medium, and three low severity. The [in-toto project response](https://in-toto.io/blog/2023/security-audit/) explains their scope and the maintainers’ decisions.

 

Several findings concern the assumptions a verifier makes: which file properties are covered, whether metadata can be reused, which configuration is authoritative, and whether the process producing a statement is trustworthy.

 

## TestifySec’s response at the time

 

Our [June 2023 Witness tracking issue](https://github.com/in-toto/witness/issues/268) proposed work on file metadata, configuration capture, policy freshness, reuse of evidence, and isolation from the build process. It also recorded the decision not to support PGP in Witness.

 

Those were proposals. The issue and this article do not establish delivery in a particular release. The planned Omnitrail container and Archivista/TUF integration must not be read as current product capabilities.

 

## Corrections that matter for implementation

 **File contents and file attributes are different claims.** A digest of file contents does not necessarily cover permissions or other filesystem metadata. The [file metadata advisory](https://github.com/in-toto/specification/security/advisories/GHSA-wqrg-wjp9-wqfq) discusses packaging or separately inspecting attributes that matter to a deployment. **Untrusted configuration can change what is observed.** The original article repeated the file-metadata advisory identifier for this separate finding. The correct [configuration advisory is GHSA-wc64-c5rv-32pf](https://github.com/in-toto/in-toto/security/advisories/GHSA-wc64-c5rv-32pf). It describes how a local configuration file could alter recording behavior in the affected Python implementation. **A signing identity does not establish machine integrity.** Our original response overstated what Sigstore and SPIRE key providers could establish. Attributing a statement to a principal does not prove that the principal’s machine, observation process, or report was trustworthy. Verification policy must account for the evidence producer and the environment in which it ran. **Freshness and reuse need explicit rules.** A correctly signed record can still refer to the wrong artifact, execution, or policy version. Decide which reuse is intended and bind the acceptance decision to the required context. 

## Working with Witness today

 

Use the [Witness documentation](https://witness.dev/docs/) and the release notes for [Witness](https://github.com/in-toto/witness/releases) and [go-witness](https://github.com/in-toto/go-witness/releases) to assess the version you deploy. Reproduce both accepted and rejected cases for your policy.

 

For TestifySec’s commercial system, the [trust architecture](https://www.testifysec.com/docs/cilock/trust) describes the current product boundaries. The historical audit does not certify CI/lock, Pushgate, or the platform.