Skip to content

trestle.core.commands.verify_manifest

trestle.core.commands.verify_manifest ¤

Trestle Verify Manifest Command.

Attributes¤

logger = logging.getLogger(__name__) module-attribute ¤

Classes¤

VerifyManifestCmd ¤

Bases: CommandBase


              flowchart TD
              trestle.core.commands.verify_manifest.VerifyManifestCmd[VerifyManifestCmd]
              trestle.core.commands.command_docs.CommandBase[CommandBase]

                              trestle.core.commands.command_docs.CommandBase --> trestle.core.commands.verify_manifest.VerifyManifestCmd
                


              click trestle.core.commands.verify_manifest.VerifyManifestCmd href "" "trestle.core.commands.verify_manifest.VerifyManifestCmd"
              click trestle.core.commands.command_docs.CommandBase href "" "trestle.core.commands.command_docs.CommandBase"

Verify a JSON package manifest against a detached DSSE envelope.

Verification checks the package DSSE signature, validates the signed in-toto package Statement, and confirms every current JSON artifact digest matches the digest recorded in the signed manifest envelope.

Source code in trestle/core/commands/verify_manifest.py 
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
class VerifyManifestCmd(CommandBase):
    """Verify a JSON package manifest against a detached DSSE envelope.

    Verification checks the package DSSE signature, validates the signed
    in-toto package Statement, and confirms every current JSON artifact digest
    matches the digest recorded in the signed manifest envelope.
    """

    name = 'verify-manifest'

    def _init_arguments(self) -> None:
        self.add_argument(
            '--manifest', help='Path to the JSON package manifest to verify.', required=True, type=pathlib.Path
        )
        self.add_argument(
            '--signature', help='Path to the detached DSSE package envelope.', required=True, type=pathlib.Path
        )
        self.add_argument(
            '--public-key', help='Path to the PEM public key for verification.', required=True, type=pathlib.Path
        )
        self.add_argument(
            '--digest-algorithm',
            choices=[algorithm.value for algorithm in Algorithm],
            help='Require this artifact digest algorithm. By default, detect it from the signed Statement.',
        )

    @beta_feature('json-manifest-signing')
    def _run(self, args: argparse.Namespace) -> int:
        """Verify a JSON package manifest."""
        try:
            log.set_log_level_from_args(args)
            self.verify_manifest(
                args.manifest,
                args.signature,
                args.public_key,
                digest_algorithm=Algorithm(args.digest_algorithm) if args.digest_algorithm else None,
            )
            return CmdReturnCodes.SUCCESS.value
        except Exception as e:  # pragma: no cover
            return handle_generic_command_exception(e, logger, 'Error while verifying package manifest signature')

    @classmethod
    def verify_manifest(
        cls,
        manifest_path: pathlib.Path,
        signature_path: pathlib.Path,
        public_key_path: pathlib.Path,
        digest_algorithm: Optional[Algorithm] = None,
    ) -> None:
        """Verify a detached DSSE envelope for a JSON package manifest."""
        manifest = load_signing_manifest(manifest_path.resolve())
        public_key = load_pem_public_key(public_key_path.resolve())
        envelope = load_dsse_envelope(signature_path.resolve())
        verify_manifest_envelope(manifest, envelope, public_key, digest_algorithm)
Attributes¤
name = 'verify-manifest' class-attribute instance-attribute ¤
Methods:¤
verify_manifest(manifest_path, signature_path, public_key_path, digest_algorithm=None) classmethod ¤

Verify a detached DSSE envelope for a JSON package manifest.

Source code in trestle/core/commands/verify_manifest.py 
76
77
78
79
80
81
82
83
84
85
86
87
88
@classmethod
def verify_manifest(
    cls,
    manifest_path: pathlib.Path,
    signature_path: pathlib.Path,
    public_key_path: pathlib.Path,
    digest_algorithm: Optional[Algorithm] = None,
) -> None:
    """Verify a detached DSSE envelope for a JSON package manifest."""
    manifest = load_signing_manifest(manifest_path.resolve())
    public_key = load_pem_public_key(public_key_path.resolve())
    envelope = load_dsse_envelope(signature_path.resolve())
    verify_manifest_envelope(manifest, envelope, public_key, digest_algorithm)

Functions:¤

handler: python