How to use the command 'in-toto-record' (with examples)
The ‘in-toto-record’ command is used to create a signed link metadata file that provides evidence for supply chain steps. It is a command-line tool that is part of the in-toto framework, which is used to secure software supply chains. The ‘in-toto-record’ command is used to start and stop a record, creating preliminary link files that can be used to track and verify the steps taken in a supply chain.
Use case 1: Start the record
Code:
in-toto-record start -n edit-files -k path/to/key_file -m .
Motivation: Starting the record is the first step in documenting and providing evidence for the supply chain steps. It allows us to create a preliminary link file that can be used to track and verify the steps taken in the supply chain. This is important for maintaining the integrity and security of the supply chain.
Explanation:
start: This argument tells the ‘in-toto-record’ command to start the record.-n edit-files: This argument specifies the name of the record, in this case, “edit-files”.-k path/to/key_file: This argument specifies the path to the key file that will be used to sign the link metadata.-m .: This argument specifies the metadata directory where the preliminary link file will be stored. In this example, it is set to the current directory.
Example output: Upon running the command, the ‘in-toto-record’ command will start the record and create a preliminary link file in the specified metadata directory. This link file will contain information about the supply chain steps taken so far.
Use case 2: Stop the record
Code:
in-toto-record stop -n edit-files -k path/to/key_file -p .
Motivation: Stopping the record is the final step in documenting and providing evidence for the supply chain steps. It allows us to finalize the link file and create a signed metadata file that can be used to verify the integrity and security of the supply chain.
Explanation:
stop: This argument tells the ‘in-toto-record’ command to stop the record.-n edit-files: This argument specifies the name of the record, in this case, “edit-files”. This should match the name used when starting the record.-k path/to/key_file: This argument specifies the path to the key file that was used to sign the link metadata.-p .: This argument specifies the path to the preliminary link file that was created when starting the record. In this example, it is set to the current directory.
Example output: Upon running the command, the ‘in-toto-record’ command will stop the record and create a signed metadata file in the same directory as the preliminary link file. This signed metadata file will contain information about the supply chain steps taken, along with a signature to verify its authenticity.
Conclusion:
The ‘in-toto-record’ command is a powerful tool for documenting and providing evidence for supply chain steps. By starting and stopping the record, you can track and verify the steps taken in a supply chain, ensuring the integrity and security of the software being delivered.
