@@ -23,7 +23,7 @@ The layout, signed by the project owners, together with the links, signed by the
23
23
designated functionaries, are released as part of the final product, and can be
24
24
validated manually or via automated tooling in, e.g. a package manager.
25
25
26
- ### Installation
26
+ ## Installation
27
27
28
28
in-toto is available on [ PyPI] ( https://pypi.org/project/in-toto/ ) and can be
29
29
installed via [ ` pip ` ] ( https://pypi.org/project/pip/ ) . See
@@ -35,9 +35,9 @@ recommendations.
35
35
pip install in-toto
36
36
```
37
37
38
- ### Create layout, run supply chain steps and verify final product
38
+ Next you'll create a layout, run supply chain steps, and verify final product.
39
39
40
- #### Layout
40
+ ## Layout
41
41
42
42
The in-toto software supply chain layout consists of the following parts:
43
43
@@ -61,7 +61,7 @@ Take a look at the
61
61
[ demo layout creation example] ( https://in-toto.readthedocs.io/en/latest/layout-creation-example.html )
62
62
for further information on how to create an in-toto layout.
63
63
64
- #### Artifact Rules
64
+ ## Artifact Rules
65
65
66
66
A software supply chain usually operates on a set of files, such as source code,
67
67
executables, packages, or the like. in-toto calls these files artifacts. A
@@ -101,9 +101,9 @@ types, their guarantees and how they are applied, take a look at the
101
101
[ Artifact Rules] ( https://github.com/in-toto/docs/blob/master/in-toto-spec.md#433-artifact-rules )
102
102
section of the in-toto specification.
103
103
104
- #### Carrying out software supply chain steps
104
+ ## Supply- chain steps
105
105
106
- ##### in-toto-run
106
+ ### in-toto-run
107
107
108
108
` in-toto-run ` is used to execute a step in the software supply chain. This can
109
109
be anything relevant to the project such as tagging a release with ` git ` ,
@@ -127,7 +127,7 @@ For a detailed list of all the command line arguments, run `in-toto-run --help`
127
127
or look at the
128
128
[ online documentation] ( https://in-toto.readthedocs.io/en/latest/command-line-tools/in-toto-run.html ) .
129
129
130
- ##### in-toto-record
130
+ ### in-toto-record
131
131
132
132
` in-toto-record ` works similar to ` in-toto-run ` but can be used for multi-part
133
133
software supply chain steps, i.e. steps that are not carried out by a single
@@ -139,12 +139,12 @@ arguments and their usage, run `in-toto-record start --help` or
139
139
` in-toto-record stop --help ` , or look at the
140
140
[ online documentation] ( https://in-toto.readthedocs.io/en/latest/command-line-tools/in-toto-record.html ) .
141
141
142
- #### Release final product
142
+ ## Release final product
143
143
144
144
In order to verify the final product with in-toto, the verifier must have access
145
145
to the layout, the ` *.link ` files, and the project owner's public key(s).
146
146
147
- #### Verification
147
+ ## Verification
148
148
149
149
Use ` in-toto-verify ` on the final product to verify that
150
150
@@ -159,7 +159,7 @@ For a detailed list of all command line arguments and their usage, run
159
159
` in-toto-verify --help ` or look at the
160
160
[ online documentation] ( https://in-toto.readthedocs.io/en/latest/command-line-tools/in-toto-verify.html ) .
161
161
162
- #### Signatures
162
+ ## Signatures
163
163
164
164
` in-toto-sign ` is a metadata signature helper tool to add, replace, and verify
165
165
signatures within in-toto Link or Layout metadata, with options to:
0 commit comments