Skip to content

SCITT Architecture & Reference APIs — draft-ietf-scitt-architecture, draft-ietf-scitt-scrapi#

IETF 122 (Bangkok) digest Program Core pick Bangkok · 15–21 March 2025

  • Tier: Core
  • Why: Software supply-chain provenance keeps being solved point-by-point (certificate transparency, container image signing); SCITT is the attempt at a single, general transparency architecture instead of another bespoke ledger — directly relevant if you're evaluating supply-chain security tooling.
  • What: architecture defines a general architecture for single-issuer signed-statement transparency across arbitrary supply chains, aiming for interoperability between transparency services and compliance with varied auditing regimes. scrapi specifies the concrete REST API — resources, request/response messages, error handling — for an interoperable SCITT Transparency Service implementation. (from abstract only)
  • How: Issuers register signed statements to a transparency service, which returns a receipt (see COSE Receipts in Wildcard) proving inclusion in an append-only, auditable log.
  • Where applicable: General; applicable to software artifacts, but the architecture is explicitly meant to generalize beyond software (see Traceability Claims in Adjacent).