OSCAL Package Predicate v1¤

Trestle uses this predicate type in the in-toto Statement created by trestle sign-manifest:

https://oscal-compass.github.io/compliance-trestle/predicates/oscal-package/v1

The predicate records the validated fields from the JSON package manifest. The predicate type URI is recorded in the signed Statement and is not fetched during verification.

For command usage, see the trestle sign-manifest and trestle verify-manifest CLI documentation.

The package manifest format is defined by the OSCAL Package Manifest v1 JSON Schema.

What is signed¤

trestle sign-manifest creates a detached DSSE envelope. The envelope payload is an in-toto Statement that records:

• the artifact names listed in the package manifest
• the SHA-256 digest of each artifact's RFC 8785 canonical JSON bytes
• the package predicate type and predicate fields described below

The DSSE signature is made over the DSSE pre-authentication encoding of the Statement payload. The package manifest and listed JSON artifacts are not modified.

The raw manifest bytes are not signed directly. Trestle validates the manifest, copies its package metadata into the predicate, records the digest of each listed artifact as a subject, and signs the resulting Statement. Verification reconstructs those values from the supplied manifest and artifacts and requires them to match the signed Statement.

Statement¤

The DSSE payload is a base64-encoded in-toto Statement with one subject for each package artifact:

{
  "_type": "https://in-toto.io/Statement/v1",
  "subject": [
    {
      "name": "ssp.json",
      "digest": {
        "sha256": "..."
      }
    },
    {
      "name": "profile.json",
      "digest": {
        "sha256": "..."
      }
    }
  ],
  "predicateType": "https://oscal-compass.github.io/compliance-trestle/predicates/oscal-package/v1",
  "predicate": {
    "tool": "compliance-trestle",
    "manifestVersion": "v1",
    "primaryArtifact": "ssp.json",
    "artifacts": [
      {
        "name": "ssp.json",
        "uri": "ssp/ssp.json",
        "mediaType": "application/oscal+json"
      },
      {
        "name": "profile.json",
        "uri": "profiles/profile.json",
        "mediaType": "application/oscal+json"
      }
    ]
  }
}

Predicate fields¤