in-toto-record

Start recording

$ in-toto-record start -n [step_name] -k [key.pem]

$ in-toto-record stop -n [step_name] -k [key.pem] -p [products]

$ in-toto-record start -n [step] -k [key] -m [src/]

$ in-toto-record stop -n [step] -k [key] -p [dist/]

in-toto-record command [options]

in-toto-record creates supply chain attestations for build steps. It records materials before and products after a step, generating signed link metadata.
The tool supports split recording where start and stop are separate commands. This allows recording steps that span multiple commands or sessions.
in-toto-record creates supply chain attestations.

start

Begin recording step.

Finish recording step.

Step name.

Signing key file.

Input materials paths.

Output products paths.

Display help information.

Requires signing key. Part of in-toto framework. Links must be verified.

in-toto-record is part of in-toto, a framework for supply chain integrity developed at NYU Secure Systems Lab.

in-toto-run(1), in-toto-sign(1), in-toto-verify(1)