signing-tool 3.6.2

Laavat Signing Solution CLI Tool

Laavat Signing Solution CLI Tool

⚠️ Reference Implementation Only — This is a reference implementation and should not be used in production. Security improvements are planned before this tool is productized. Use this for evaluation and development purposes only.

The signing-tool package provides the Laavat Signing Solution command-line client. It supports client registration, product management, image signing, secrets management, and more via the SaaS API.

Installation

Install from PyPI when released:

pip install signing-tool

Install from source during development:

cd clients/python3
python3 -m pip install .

Quick Start

Display help:

signing-tool --help

Recommended usage

Use a configuration file to keep credentials out of command history and logs. Create the file with config-init, then run the CLI using the -n option.

config-init -n test.ini -t "$TOKEN" -s -a https://app.laavat.io/<CustomerName>/api/v1
signing-tool -n test.ini product getall

Alternative usage

You can also pass settings directly on the command line, but this is less secure because tokens may become visible in shell history or process listings.

signing-tool -c -t "$TOKEN" -a https://app.laavat.io/<CustomerName>/api/v1 product getall

Configuration Options

Option 1: create an ini config file using config-init:

config-init -n test.ini -t "$TOKEN" -s -a https://app.laavat.io/<CustomerName>/api/v1
signing-tool -n test.ini product getall

Option 2: pass settings directly on the command line (not recommended for secrets):

signing-tool -c -t "$TOKEN" -a https://app.laavat.io/<CustomerName>/api/v1 product getall

Example Signing Commands

HAB image signing with config file:

signing-tool -n test.ini imagesigning add SignHABIMG -P <product-id> --operid <operator-id> -p <payload>

OCI signing with token and API address:

signing-tool -c -t "$TOKEN" -a https://app.laavat.io/<CustomerName>/api/v1 imagesigning add SignOCI -P <product-id> --operid <operator-id> -A <artifact>

Requirements

• Python 3.8 or newer
• SigningService — The signing-tool CLI depends on the SigningService API client library. This is automatically installed when you install signing-tool from PyPI

Packaging

This package is configured for PyPI distribution using pyproject.toml and setuptools. Read the pyproject.toml file for package metadata and published package configuration.