CLI
Evidence
Sign statements about files, store them as evidence and verify them.
Evidence is a signed in-toto statement about a file, such
as test results or an approval, stored next to it in a DSSE envelope. Relic
refuses evidence unless a signature verifies with the trusted key its keyid
names, and refuses evidence about a folder.
Create an ed25519 key pair (--type ecdsa|rsa for another) and have the server
trust it as ci (administrators):
relic evidence keygen --file ci-signing --alias ci
Sign a statement about a file and store it as evidence:
relic evidence create libs-local/app/1.0/app.jar \
--predicate tests.json --predicate-type https://relic.build/evidence/tests/v1 \
--key ci-signing.key --alias ci
Show a file's evidence:
relic evidence get libs-local/app/1.0/app.jar
Verify a file's evidence locally, against the server's trusted keys and the file's current SHA-256. The command exits with status 1 unless every envelope verifies:
relic evidence verify libs-local/app/1.0/app.jar
Verify against a public key file instead:
relic evidence verify libs-local/app/1.0/app.jar --public-key ci-signing.pub