CEME-SCAV-0.1 · WinMedia Certified External Machine Editions
Source profile: in-toto verification model
Verify a declared software supply-chain layout against thresholded, authorized attestation evidence and artifact-flow rules.
Verify a declared software supply-chain layout against thresholded, authorized attestation evidence and artifact-flow rules.
WinMedia Certification & Non-Endorsement
Independent WinMedia operationalization grounded in a pinned public source. Certification is by WinMedia and does not imply upstream project endorsement.
Supply-Chain Layout & Attestation Verification Machine Edition v0.1 is an independent WinMedia Certified External Machine Edition. It is not an official product of in-toto. No upstream endorsement, certification, sponsorship or trademark license is claimed. The product claim is limited to the bounded capability stated in the release envelope.
This Certified External Machine Edition has a proposed price of $39.99 USD. That price has not been set for purchase. Edition details are available to review; checkout is unavailable.
Boundary & Definition
Bounded verification profile; not the in-toto tool suite and not an upstream certification service.
The Machine Edition Factory extracts only the precise, verifiable operational model from the pinned source. It does not import unnecessary dependencies or expand scope beyond what is provably reproducible.
Explicit Exclusions
Provenance & Source Profile
Clear documentary provenance grounded in pinned public repositories and explicit version identifiers.
Source Profile Label: in-toto verification model
Upstream Project: in-toto
Repository: in-toto/in-toto
Pinned Commit: e352b43ad7cb8915d84c36d791aa61346152a0a3
Pinned Source Path: in_toto/in_toto_verify.py
Git Blob SHA-1: 246dac1931bce00d6abb899f12befe6a68598dce
License Basis: Apache-2.0
Relationship: SOURCE_PROFILE_ONLY_NOT_ENDORSEMENT
WinMedia independently executed capability qualification, source/rights verification, conformance testing, admission, and release authorization.
Packaging & Fulfillment
Each Certified External Machine Edition is represented by one governed commercial delivery artifact and one public companion artifact.
The authoritative, immutable commercial package containing machine-executable schemas, contracts, test fixtures, manifest, and provenance bindings.
intoto-candidate-v0.1-governed.zip
SHA-256: 05a95101f0a1f5579acf50ded998445f56547f947fd46b9ff04876ba2888b4ac
Delivered via secure, signed fulfillment links upon authorized purchase.
Proposed reference and evaluation companion. The public companion is not a separate paid SKU. It becomes downloadable only when its publication status is explicitly marked PUBLISHED.
intoto-candidate-v0.1-public-companion.zip
SHA-256: 6f2b8dbe1f0477d45962c9a5f86ab2a45eb4126ceea4642d7b251b38f5829011
Legal & Attribution Disclosures
Derived from the in-toto supply chain verification model by the in-toto contributors. Independently processed and certified through WinMedia's Machine Edition Factory. WinMedia is not affiliated with, sponsored by, or endorsed by in-toto or its maintainers.
Supply-Chain Layout & Attestation Verification Machine Edition v0.1 is an independent WinMedia Certified External Machine Edition. It is not an official product of in-toto. No upstream endorsement, certification, sponsorship or trademark license is claimed. The product claim is limited to the bounded capability stated in the release envelope.
Certified External Machine Editions are independent WinMedia operationalizations of bounded capabilities grounded in pinned public sources. Certification is by WinMedia and does not imply approval, partnership, certification, or endorsement by any upstream project.
