SBOMit = SBOM + in-toto

An SBOM tells you what’s in the software.

SBOMit helps you verify how it got there.

It adds in-toto attestations as the supply chain runs.

Anyone who receives your software can check these attestations and get strong assurance about how it was built.