Skip to content

README.md

Latest commit

 

History

History
89 lines (62 loc) · 2.34 KB

README.md

File metadata and controls

89 lines (62 loc) · 2.34 KB
Raw

Attestation Result Command

arc (attestation result command) allows:

  • synthesising attestation results in EAR (EAT Attestation Result) format,
  • cryptographically verifying and displaying the contents of an EAR
  • printing the EAR header and payload without verification

Create

The create sub-command is used to synthesise an EAR given the full claims-set.

arc create \
    [--claims <file>] \
    [--skey <signing key>] \
    [--alg <alg>] \
    <jwt-file>

Parameters

parameter meaning
--claims EAR claims-set in JSON (default to ${PWD}/ear-claims.json)
--skey signing key in JWK format (default to ${PWD}/skey.json)
--alg JWS algorithm
<jwt-file> the signed EAR claims-set in JWT format

Output

A one-liner saying success status and path of the JWT file that was created.

Verify

The verify sub-command is used to cryptographically verify and pretty-print the contents of a EAR, including the trustworthiness vector.

arc verify \
    [--pkey <file>] \
    [--alg <alg>] \
    [--verbose] \
    [--color] \
    <jwt-file>

Parameters

parameter meaning
--pkey verification key in JWK format (default to ${PWD}/pkey.json)
--alg JWS algorithm
--verbose trustworthiness vector detailed report (default is brief)
--color trustworthiness vector report colourises the tiers (default is B&W)
<jwt-file> a JWT wrapping an EAR claims-set

If the --pkey parameter is omitted or the default file name is specified, the key from the file will be used if it exists, ignoring the keys in the JWT header. Instead, if the file is missing, the public key and algorithm from the JWT header will be used.

Output

  • Validation status of the cryptographic signature.

If successful:

  • The EAR claims-set is printed to stdout.
  • If present, the decoded trust vector is also printed to stdout (the exact format depends on --verbose and --color).

Print

The print sub-command is used to print the contents of a EAR, including the header. Neither EAR validation nor verification is executed.

arc print <jwt-file>

Parameters

parameter meaning
<jwt-file> a JWT wrapping an EAR claims-set

Output

If EAR is successfully parsed:

  • The EAR header and payload are printed to stdout.