How to use the command 'in-toto-sign' (with examples)

The ‘in-toto-sign’ command is a part of the ‘in-toto’ framework, which is a security extension for software supply chain assurance. This command is used to sign or verify the signatures of in-toto link or layout metadata. It can be especially useful in ensuring the integrity and authenticity of software packages within a supply chain.

Use case 1: Signing a layout file with multiple keys

Code:

in-toto-sign -f unsigned.layout -k priv_key1 priv_key2 -o root.layout

Motivation: In a supply chain, it is important to have multiple signatures from different individuals or entities to ensure trust and integrity. By signing a layout file with multiple keys, you can enhance the security and accountability of the software package.

Explanation:

• The ‘-f’ flag specifies the input file, which is the unsigned layout file in this case.
• The ‘-k’ flag is used to specify the private keys to sign the layout with. In this example, ‘priv_key1’ and ‘priv_key2’ are the private keys used for signing.
• The ‘-o’ flag is optional and is used to specify the output file name. If not provided, the signed layout is written to the default file name.

Example output: The layout file ‘unsigned.layout’ is signed with the private keys ‘priv_key1’ and ‘priv_key2’, and the signed layout is saved as ‘root.layout’.

Use case 2: Replacing the signature in a link file

Code:

in-toto-sign -f package.2f89b927.link -k priv_key

Motivation: When a link file already exists but needs to be updated or modified, it is important to replace the existing signature to maintain the integrity and authenticity. This use case demonstrates how to replace the signature in a link file.

Explanation:

• The ‘-f’ flag specifies the input file, which is the link file in this case.
• The ‘-k’ flag is used to specify the private key to sign the link with. In this example, ‘priv_key’ is the private key used for signing.
• Since the ‘-o’ flag is not provided, the modified link file with the replaced signature will be written to the default file name.

Example output: The signature in the link file ‘package.2f89b927.link’ is replaced with the new signature created using the private key ‘priv_key’.

Use case 3: Verifying a layout file signed with multiple keys

Code:

in-toto-sign -f root.layout -k pub_key0 pub_key1 pub_key2 --verify

Motivation: Verifying the signatures of layout files is crucial to ensure the authenticity and integrity of the software package. This use case demonstrates how to verify a layout file signed with multiple public keys.

Explanation:

• The ‘-f’ flag specifies the input file, which is the layout file in this case.
• The ‘-k’ flag is used to specify the public keys to verify the layout with. In this example, ‘pub_key0’, ‘pub_key1’, and ‘pub_key2’ are the public keys used for verification.
• The ‘–verify’ flag is used to indicate that the command should verify the signatures in the layout file.

Example output: The layout file ‘root.layout’ is successfully verified, and the signatures are valid. This ensures the authenticity and integrity of the software package.

Use case 4: Signing a layout file with the default GPG key

Code:

in-toto-sign -f root.layout --gpg

Motivation: The ‘in-toto-sign’ command provides the option to sign a layout file with the default GPG key. GPG (GNU Privacy Guard) is a widely-used encryption software that ensures secure communication and data integrity. This use case demonstrates how to use the default GPG key for signing.

Explanation:

• The ‘-f’ flag specifies the input file, which is the layout file in this case.
• The ‘–gpg’ flag is used to indicate that the command should sign the layout file with the default GPG key.

Example output: The layout file ‘root.layout’ is signed with the default GPG key present in the default GPG keyring.

Use case 5: Verifying a layout file with a specific GPG key

Code:

in-toto-sign -f root.layout --verify --gpg ...439F3C2

Motivation: In situations where a specific GPG key needs to be used for verification, the ‘in-toto-sign’ command allows you to specify the key by its key ID. This use case demonstrates how to verify a layout file using a specific GPG key identified by its key ID.

Explanation:

• The ‘-f’ flag specifies the input file, which is the layout file in this case.
• The ‘–verify’ flag is used to indicate that the command should verify the signatures in the layout file.
• The ‘–gpg’ flag is used to indicate GPG signature verification.
• The key ID ‘…439F3C2’ represents the specific GPG key to be used for verification.

Example output: The layout file ‘root.layout’ is successfully verified using the GPG key identified by the key ID ‘…439F3C2’, ensuring the authenticity and integrity of the software package.

Conclusion:

The ‘in-toto-sign’ command is a versatile tool that allows you to sign or verify the signatures of in-toto link and layout metadata. By using this command, you can enhance the security and trustworthiness of software packages within a supply chain. The examples provided demonstrate different use cases of this command, showcasing its flexibility and compatibility with various cryptographic keys and tools.