diff --git a/content/developers/developer-patterns/scitt-api/index.md b/content/developers/developer-patterns/scitt-api/index.md index b963c4eaa..8205cad18 100644 --- a/content/developers/developer-patterns/scitt-api/index.md +++ b/content/developers/developer-patterns/scitt-api/index.md @@ -54,7 +54,7 @@ Clone the [DataTrails SCITT Examples](https://github.com/datatrails/datatrails-s 1. Create a Python Virtual Environment for the sample scripts and install the dependencies ```bash - python -m venv venv && \ + python3 -m venv venv && \ source venv/bin/activate && \ trap deactivate EXIT && \ pip install --upgrade pip && \ @@ -74,22 +74,16 @@ Clone the [DataTrails SCITT Examples](https://github.com/datatrails/datatrails-s ISSUER="sample.synsation.io" # signing key to sign the SCITT Statements - SIGNING_KEY="/tmp/my-signing-key.pem" + SIGNING_KEY="my-signing-key.pem" # File representing the signed statement to be registered - SIGNED_STATEMENT_FILE="/tmp/signed-statement.cbor" + SIGNED_STATEMENT_FILE="signed-statement.cbor" # File representing the transparent statement, which includes the signed statement and the registration receipt - TRANSPARENT_STATEMENT_FILE="/tmp/transparent-statement.cbor" + TRANSPARENT_STATEMENT_FILE="transparent-statement.cbor" # Property used to correlate a collection of statements about an artifact SUBJECT="my-product-id" - - # Sub Directory for SCITT scripts - SCRIPTS="datatrails_scitt_samples/scripts/" - - # For local script execution, help Python find the modules - export PYTHONPATH="${PYTHONPATH}:$SCRIPTS" ``` ## Create a Signing Key @@ -109,7 +103,7 @@ For the Quickstart, create a testing key which DataTrails will cryptographically Create any payload you wish to register on DataTrails. ```bash -cat > /tmp/payload.json < payload.json < /tmp/metadata.json < metadata.json < - ```bash -python ${SCRIPTS}create_hashed_signed_statement.py \ +python3 -m datatrails_scitt_samples.scripts.create_hashed_signed_statement \ --content-type "application/json" \ --issuer $ISSUER \ - --metadata-file "/tmp/metadata.json" \ + --metadata-file "metadata.json" \ --output-file $SIGNED_STATEMENT_FILE \ - --payload-file /tmp/payload.json \ + --payload-file payload.json \ --payload-location "https://storage.example/$SUBJECT" \ --signing-key-file $SIGNING_KEY \ --subject $SUBJECT @@ -171,30 +149,67 @@ python ${SCRIPTS}create_hashed_signed_statement.py \ ## Register the SCITT Signed Statement on DataTrails 1. Submit the Signed Statement to DataTrails, using the credentials in the `DATATRAILS_CLIENT_ID` and `DATATRAILS_CLIENT_SECRET`. + The `LEAF` is captured on a successful execution for verification. ```bash - python ${SCRIPTS}register_signed_statement.py \ - --signed-statement-file $SIGNED_STATEMENT_FILE \ - --output-file $TRANSPARENT_STATEMENT_FILE \ - --log-level INFO + RESPONSE=$(python3 -m datatrails_scitt_samples.scripts.register_signed_statement \ + --signed-statement-file $SIGNED_STATEMENT_FILE \ + --output-file $TRANSPARENT_STATEMENT_FILE \ + --log-level INFO) + echo $RESPONSE + ``` + + The last line of the output will include the leaf entry that commits the statement to the merkle log. + It will look like + + ```json + { + "entryid": "assets_b9d32c32-8ab3-4b59-8de8-bd6393167450_events_7dd2a825-495e-4fc9-b572-5872a268c8a9", + "leaf": "30f5650fbe3355ca892094a3fbe88e5fa3a9ae47fe3d0bbace348181eb2b76db" + } ``` 1. View the Transparent Statement, as a result of registering the Signed Statement ```bash - python datatrails_scitt_samples/dump_cbor.py \ + python3 -m datatrails_scitt_samples.dump_cbor \ --input $TRANSPARENT_STATEMENT_FILE ``` - + + A more representative example, which includes computing the leaf hash from the event details, can be found in the [tests for the verification script](https://github.com/datatrails/datatrails-scitt-samples/blob/main/tests/test_verify_receipt.py#L52) + + ## Retrieve Statements for the Artifact @@ -209,6 +224,13 @@ By querying the series of statements, consumers can verify who did what and when | jq ``` + The events are listed starting with the most recently added. + +{{< note >}} +Coming soon: Filter on specific values conveyed in the protected header. +For example, content types, such as what SBOMs have been registered, which issuers have made statements or custom key-value pairs. +{{< /note >}} + ## Summary The quickstart created a collection of statements for a given artifact.