Package: in-toto
in-totoin-toto provides a framework to protect the integrity of the software supply chain. It does so by verifying that each task in the chain is carried out as planned, by authorized personnel only, and that the product is not tampered with in transit.in-toto requires aproject ownerto create alayout. A layout lists the sequence ofstepsof the software supply chain, and thefunctionariesauthorized to perform these steps.
When a functionary performs a step in-toto gathers information about the used command and the related files and stores it in alinkmetadata file. As a consequence link files provide the required evidence to establish a continuous chain that can be validated against the steps defined in the layout.The layout, signed by the project owners, together with the links, signed by the designated functionaries, are released as part of the final product, and can be validated manually or via automated tooling in, e.g. a package manager.Getting StartedInstallationin-toto is available onPyPIand can be
installed viapip. Seein-toto.readthedocs.ioto learn about system dependencies and installation alternatives and
recommendations.pipinstallin-totoCreate layout, run supply chain steps and verify final productLayoutThe in-toto software supply chain layout consists of the following parts:expiration datereadme(an optional description of the supply chain)functionary keys(public keys, used to verify link metadata signatures)signatures(one or more layout signatures created with the project owner key(s))software supply chain stepscorrespond to steps carried out by a functionary as part of the software supply chain. The steps defined in the layout list the functionaries who are authorized to carry out the step (by key id). Steps require a unique name to associate them (upon verification) with link metadata that is created when a functionary carries out the step using thein-tototools. Additionally, steps must have material and product rules which define the files a step is supposed to operate on. Material and product rules are described in the section below.inspectionsdefine commands to be run during the verification process and can also list material and product rules.Take a look at thedemo layout creation examplefor further information on how to create an in-toto layout.Artifact RulesA software supply chain usually operates on a set of files, such as source code, executables, packages, or the like. in-toto calls these files artifacts. A material is an artifact that will be used when a step or inspection is carried out. Likewise, a product is an artifact that results from carrying out a step.The in-toto layout provides a simple rule language to authorize or enforce the artifacts of a step and to chain them together. This adds the following guarantees for any given step or inspection:Only artifactsauthorizedby the project owner are created, modified or deleted,each defined creation, modification or deletion isenforced, and alsorestricted to the scope of its definition, whichchainssubsequent steps and inspections together.Note that it is up to you to properly secure your supply chain, by authorizing, enforcing and chaining materials and products using any and usually multiple of the following rules:CREATE <pattern>DELETE <pattern>MODIFY <pattern>ALLOW <pattern>DISALLOW <pattern>REQUIRE <file>MATCH <pattern> [IN <source-path-prefix>] WITH (MATERIALS|PRODUCTS) [IN <destination-path-prefix>] FROM <step>Rule arguments specified as<pattern>allow for Unix shell-style wildcards as implemented by Python'sfnmatch.in-toto's Artifact Rules, by default, allow artifacts to exist if they are not explicitly disallowed. As such, aDISALLOW *invocation is recommended as the final rule for most step definitions. To learn more about the different rule types, their guarantees and how they are applied, take a look at theArtifact Rulessection of the in-toto specification.Carrying out software supply chain stepsin-toto-runin-toto-runis used to execute a step in the software supply chain. This can
be anything relevant to the project such as tagging a release withgit,
running a test, or building a binary. The relevant step name and command are
passed as arguments, along with materials, which are files required for that
step's command to execute, and products which are files expected as a result
of the execution of that command. These, and other relevant details
pertaining to the step are stored in a link file, which is signed using the
functionary's key.If materials are not passed to the command, the link file generated just
doesn't record them. Similarly, if the execution of a command viain-toto-rundoesn't result in any products, they're not recorded in the link
file. Any files that are modified or used in any way during the execution of
the command are not recorded in the link file unless explicitly passed as
artifacts. Conversely, any materials or products passed to the command are
recorded in the link file even if they're not part of the execution
of the command.Seethis simple usage example from the demo application
for more details.
For a detailed list of all the command line arguments, runin-toto-run --helpor look at theonline
documentation.in-toto-recordin-toto-recordworks similar toin-toto-runbut can be used for
multi-part software supply chain steps, i.e. steps that are not carried out
by a single command. Usein-toto-record start ...to create a
preliminary link file that only records thematerials, then run the
commands of that step or edit files manually and finally usein-toto-record stop ...to record theproductsand generate the actual
link metadata file. For a detailed list of all command line arguments and their usage,
runin-toto-record start --helporin-toto-record stop --help, or look at
theonline
documentation.Release final productIn order to verify the final product with in-toto, the verifier must have access to the layout, the*.linkfiles,
and the project owner's public key(s).VerificationUsein-toto-verifyon the final product to verify thatthe layout was signed with the project owner's private key(s),has not expired,each step was performed and signed by the authorized functionary,the functionaries used the commands, they were supposed to use,materials and products of each step were in place as defined by the rules, andrun the defined inspectionsFor a detailed list of all command line arguments and their usage, runin-toto-verify --helpor look at theonline
documentation.Signaturesin-toto-signis a metadata signature helper tool to add, replace, and
verify signatures within in-toto Link or Layout metadata, with options to:replace (default) or add signature(s), with layout metadata able to be
signed by multiple keys at once while link metadata can only be signed by one key at a timewrite signed metadata to a specified path (if no output path is specified,
layout metadata is written to the path of the input file while link metadata
is written to<name>.<keyid prefix>.link)verify signaturesThis tool serves well to re-sign test and demo data. For example, it can be used
if metadata formats or signing routines change.For a detailed list of all command line arguments and their usage, runin-toto-sign --helpor look at theonline
documentation.in-toto demoYou can try in-toto by running thedemo application.
The demo basically outlines three users viz., Alice (project owner), Bob (functionary) and Carl (functionary) and how in-toto helps to specify a project layout and verify that the layout has been followed in a correct manner.SpecificationYou can read more about how in-toto works by taking a look at thespecification.Security Issues and BugsSeeSECURITY.md.Governance and ContributingFor information about in-toto's governance and contributing guidelines, seeGOVERNANCE.md.AcknowledgmentsThis project is managed by Prof. Santiago Torres-Arias at Purdue University.
It is worked on by many folks in academia and industry, including members of
theSecure Systems Labat NYU and theNJIT Cybersecurity Research Center.This research was supported by the Defense Advanced Research Projects Agency
(DARPA), the Air Force Research Laboratory (AFRL), and the US National Science
Foundation (NSF). Any opinions, findings, and conclusions or recommendations
expressed in this material are those of the authors and do not necessarily
reflect the views of DARPA, AFRL, and NSF. The United States Government is
authorized to reproduce and distribute reprints notwithstanding any copyright
notice herein.