CEME-SCAV-0.1 · WinMedia Certified External Machine Editions
Source profile: in-toto verification model
Verify a declared software supply-chain layout against thresholded, authorized attestation evidence and artifact-flow rules.
Verify a declared software supply-chain layout against thresholded, authorized attestation evidence and artifact-flow rules.
WinMedia Certification & Non-Endorsement
Independent WinMedia operationalization grounded in a pinned public source. Certification is by WinMedia and does not imply upstream project endorsement.
Supply-Chain Layout & Attestation Verification Machine Edition v0.1 is a WinMedia Certified External Machine Edition. It is not an official product of in-toto. No upstream endorsement, certification, sponsorship or trademark license is claimed. The product claim is limited to the bounded capability stated in PRODUCT.md and the immutable governed/public artifacts identified in release-envelope.json.
The individual list price is $39.99 USD. Checkout is temporarily unavailable while this edition's commerce gate is closed.
Boundary & Definition
Bounded verification profile; not the in-toto tool suite and not an upstream certification service.
The Machine Edition Factory extracts only the precise, verifiable operational model from the pinned source. It does not import unnecessary dependencies or expand scope beyond what is provably reproducible.
Explicit Exclusions
Provenance & Source Profile
Clear documentary provenance grounded in pinned public repositories and explicit version identifiers.
Source Profile Label: in-toto verification model
Upstream Project: in-toto
Repository: in-toto/in-toto
Pinned Commit: e352b43ad7cb8915d84c36d791aa61346152a0a3
Pinned Source Path: in_toto/in_toto_verify.py
Git Blob SHA-1: 246dac1931bce00d6abb899f12befe6a68598dce
License Basis: Apache-2.0
Relationship: SOURCE_PROFILE_ONLY_NOT_ENDORSEMENT
WinMedia independently executed capability qualification, source/rights verification, conformance testing, admission, and release authorization.
Packaging & Fulfillment
Each Certified External Machine Edition is represented by one governed commercial delivery artifact and one public companion artifact.
The authoritative, immutable commercial package containing capability contracts, bounded implementations, test fixtures, a package manifest, and provenance bindings.
supply-chain-layout-attestation-verification-machine-edition-v0.1.zip
SHA-256: 9212c9230855fc24f9dc629794c83c4cbfea197239fd08e931435ed4d3533868
Delivered via secure, signed fulfillment links upon authorized purchase.
Proposed reference and evaluation companion. The public companion is not a separate paid SKU. It becomes downloadable only when its publication status is explicitly marked PUBLISHED.
intoto-candidate-v0.1-public-companion.zip
SHA-256: 6f2b8dbe1f0477d45962c9a5f86ab2a45eb4126ceea4642d7b251b38f5829011
Legal & Attribution Disclosures
Source profile: in-toto verification model Upstream project: in-toto Repository: in-toto/in-toto Pinned commit: e352b43ad7cb8915d84c36d791aa61346152a0a3 Pinned path: in_toto/in_toto_verify.py Pinned Git blob SHA-1: 246dac1931bce00d6abb899f12befe6a68598dce License basis: Apache-2.0 WinMedia independently created the capability extraction, bounded machine realization, evaluation, governance, certification and packaging represented by this Machine Edition. The upstream project and its contributors did not submit, certify, sponsor or endorse this WinMedia product. Upstream names are used only to identify provenance.
Supply-Chain Layout & Attestation Verification Machine Edition v0.1 is a WinMedia Certified External Machine Edition. It is not an official product of in-toto. No upstream endorsement, certification, sponsorship or trademark license is claimed. The product claim is limited to the bounded capability stated in PRODUCT.md and the immutable governed/public artifacts identified in release-envelope.json.
Certified External Machine Editions are independent WinMedia operationalizations of bounded capabilities grounded in pinned public sources. Certification is by WinMedia and does not imply approval, partnership, certification, or endorsement by any upstream project.
