Awesome
Grafeas + in-toto
This repository provides an interface that converts standard in-toto link files into Grafeas occurrences, and vice versa, in an in-toto-verifiable manner. Grafeas supports in-toto attestations as a note and occurrence kind since v0.1.6. However, the format of the document supported in Grafeas is slightly different from the default attestations generated by the in-toto reference implementations.
Use
To convert an in-toto link into a Grafeas in-toto occurrence:
from totoify_grafeas.totoifylib import GrafeasInTotoOccurrence
# in_toto_link is of type in_toto.models.metadata.Metablock enclosing an instance of in_toto.models.link.Link
# step_name and resource_uri are strings
# from_link returns a totoify_grafeas.totoifylib.GrafeasInTotoOccurrence
GrafeasInTotoOccurrence.from_link(in_toto_link, step_name, resource_uri)
This interface will return a Grafeas in-toto occurrence, which can be stored in a Grafeas server using typical methods.
To convert a Grafeas in-toto occurrence into an in-toto link:
from totoify_grafeas.totoifylib import GrafeasInTotoOccurrence
# path is a string that points to a Grafeas in-toto Occurrence
g = GrafeasInTotoOccurrence.load(path)
# step_name is a string that specifies the step the link corresponds to
# to_link returns a Metablock enclosing a Link
g.to_link(step_name)
This interface will return an in-toto link, which can be used to perform in-toto verification.
Planned Features:
- A Grafeas transport - this would allow users to send a Grafeas in-toto occurrence to a specified Grafeas server
- Grafeas occurrence generation in the referece implementation - the option to generate a Grafeas occurrence in the in-toto Python implementation instead of the traditional links