Command Line Tools

in-toto provides various command line tools that you can use to generate, consume, modify and verify in-toto metadata. Detailed usage instructions for each tool, along with examples, are provided below.

Note

Cryptographic Signatures

in-toto metadata is signed with cryptographic keys. The CLI accepts key files in standard PEM format. See in-toto#662 for details about key generation.

Evidence Generation

• in-toto-run: generate signed link metadata
  • Required Named Arguments
  • Positional Arguments
  • Options
  • Example Usage
• in-toto-record: generate signed link metadata in multiple steps
  • Positional Arguments
  • Options
  • Sub-commands
  • Example Usage
• in-toto-match-products: match local artifacts against link metadata products
  • Required Named Arguments
  • Options

Supply Chain Verification

• in-toto-verify: perform final product supply chain verification
  • Required Named Arguments
  • Options
  • Example Usage

Utilities

• in-toto-mock: mock in-toto-run
  • Required Named Arguments
  • Positional Arguments
  • Options
  • Example Usage
• in-toto-sign: sign/verify individual pieces of metadata
  • Required Named Arguments
  • Options
  • Example Usage