in-toto-run

Run and record command

$ in-toto-run -n [step_name] -k [key.pem] -- [command]

$ in-toto-run -n [build] -k [key] -m [src/] -p [dist/] -- make

$ in-toto-run -n [step] -k [key] --exclude [*.log] -- ./build.sh

$ in-toto-run -n [step] -k [key] -m [files] -p [files]

in-toto-run [options] [-- command]

in-toto-run executes a command while recording supply chain metadata. It captures materials before execution and products after, creating a signed link file.
The tool is central to in-toto supply chain security. Each link provides cryptographic proof of what inputs and outputs a build step had.

-n NAME

Step name for link metadata.

Private key for signing.

Materials (inputs) to record.

Products (outputs) to record.

Exclude files matching pattern.

Command to run (alternative to --).

Display help information.

Requires signing key. Links must match layout. Python-based tool.

in-toto-run is the primary recording tool in in-toto, developed at NYU for protecting software supply chain integrity.

in-toto-record(1), in-toto-verify(1), in-toto-sign(1)