SCITT: Architecture for Trustworthy and Transparent Digital Supply Chains — draft-ietf-scitt-architecture#
IETF 123 (Madrid) digest Program Wildcard pick Madrid · 19–25 July 2025
- Tier: Wildcard
- Why: Software supply-chain integrity as an IETF-standardized transparency layer (think CT logs, generalized to any supply-chain statement). It's a signal of where "verifiable provenance" is heading, and it leans on the same COSE/receipts primitives as the identity work — a cross-pollination worth seeing even if it's not your day job.
- What: An architecture for registering signed supply-chain statements in append-only transparency services that issue verifiable receipts. (from abstract only)
- How: Statements are signed (COSE) and recorded so a verifier can later confirm inclusion via a receipt, giving tamper-evident provenance.
- Where applicable: General software supply-chain and artifact provenance; relevant to anyone consuming signed build/attestation metadata.