OSCAL Signing Predicate v1¤

Trestle uses this predicate type in the in-toto Statement created by trestle sign:

https://oscal-compass.github.io/compliance-trestle/predicates/oscal-signing/v1

The predicate describes how trestle created the digest for a signed JSON artifact. The predicate type URI is recorded in the signed Statement and is not fetched during verification.

For command usage, see the trestle sign and trestle verify CLI documentation.

What is signed¤

trestle sign creates a detached DSSE envelope. The envelope payload is an in-toto Statement that records:

• the subject file name
• the SHA-256 digest of the RFC 8785 canonical JSON bytes
• the predicate type and predicate fields described below

The DSSE signature is made over the DSSE pre-authentication encoding of the Statement payload. The original JSON file is not modified.

Statement¤

The DSSE payload is a base64-encoded in-toto Statement with exactly one subject:

{
  "_type": "https://in-toto.io/Statement/v1",
  "subject": [
    {
      "name": "catalog.json",
      "digest": {
        "sha256": "..."
      }
    }
  ],
  "predicateType": "https://oscal-compass.github.io/compliance-trestle/predicates/oscal-signing/v1",
  "predicate": {
    "canonicalization": "RFC8785",
    "digestAlgorithm": "sha256",
    "digestSource": "canonical-json",
    "tool": "compliance-trestle"
  }
}

Predicate fields¤