Project: in-toto (Provisioning / Security & Compliance)
File: review_3_june_20.md

We have reached the end of our 2020 roadmap and it is time to do a final review of how the in-toto reference implementation has held up to its goals for this year. In this document, we will cover the activities from January to June 2020 in the context of the goals for this ROADMAP as well as other newsworthy developments. Our main objective of the past year was to revise and consolidate all of the in-toto code- and usage-documentation in order to tie down the public API for a 1.0 release. We are very excited to announce that we did indeed finalize both the CLI documentation that was already in the works during our last roadmap evaluation, and have since then also created comprehensive API and metadata model documentation, and updated and added many usage examples. This work includes among other things a revision and standardization of the docstrings of all public-facing functions, classes and methods, as well as their automated release on . Automate documentation () Revise and consolidate documentation () Major CLI documentation overhaul and automation () Revise and update source code documentation and build with sphinx () Despite the vast improvements in our documentation and the resulting stability of the API, we decided to hold off the 1.0 release until we have sorted out one final issue. That is, a clean-up of the utility and keys module: Factor out in_toto.util to securesystemslib + general revision () Some of below issues will be closed together with , others will be carried over into the next roadmap, and some were deemed to no longer qualify for the reference implementation roadmap at

Define stable API () -- *mostly addressed via modulo , will be addressed early on as part of roadmap '21* Revisit exception taxonomy () -- *the current taxonomy is now thoroughly documented via but the issue is kept to motivate future enhancements as part of the roadmap '21* Verify in-toto's supply chain with in-toto () -- *will be carried over to the roadmap '21* Parametrize writing of inspection links () -- *no more roadmap priority, also see for important preparatory work for the issue* Require fully conformant metadata when loading () -- *no more roadmap priority* Integrate/require inspection commands () -- *no more roadmap priority* Revisit artifact rule path patterns () -- *was transferred to specification issue tracker* We are working hard to make 1.0 become a reality early in the next roadmap. We are preparing this evaluation period's pre-release, which includes a bug fix, a new feature and clean-up work in the unit test suite. Bugfix: Use kwargs in in-toto-run to fix lstrip-paths bug () Feature: Add a flag to accept a target directory to put generated metadata () Tests: Add tmp dir and gpg key test mixins () Tests: Use constant from securesystemslib to detect GPG in tests () Tests: Enhance test suite feedback on Windows () On a related side-note, together with the TUF team we have made exciting progress in in-toto's in-house crypto and utility library -- securesystemslib: A PKCS11-based HSM interface () nistp384 signature verification support () A filesystem abstraction for non-local filesystems () We plan to adopt some of these features for in-toto in next as part of roadmap '21. We acknowledge that we missed our main roadmap '20 goal, that is the release of in-toto 1.0. But it should be noted that it is a close miss and we are confident about our decision to hold off the release until we have dealt with the last remaining blemish (i.e. , so that we can guarantee the longer-term stability of the 1.0 API. What is more, we are proud of the many enhancements and the strengthening the reference implementation received in the past year and continues to receive. With the help of many talented students and an ever-growing open source community, the in-toto reference implementation will certainly maintain and also expand its central role in the supply chain security ecosystem, both as a production-ready tool, and also as a reference for other the many emerging in-toto implementations.