signing-tool 3.7.0

Laavat Signing Solution CLI Tool

Laavat Signing Solution CLI Tool

⚠️ Reference Implementation Only — This is a reference implementation and should not be used in production. Security improvements are planned before this tool is productized. Use this for evaluation and development purposes only.

The signing-tool package provides the Laavat Signing Solution command-line client. It supports client registration, product management, image signing, secrets management, and more via the SaaS API.

Installation

Install from PyPI when released:

pip install signing-tool

Install from source during development:

cd clients/python3
python3 -m pip install .

Quick Start

Display help:

signing-tool --help

Secure token input

Passing the token directly with -t "$TOKEN" exposes it in your shell history and in process listings (ps, /proc/<pid>/cmdline). To avoid this, the -t option accepts curl-style references that keep the secret out of the command line:

• -t @- — read the token from stdin:

  printf '%s' "$TOKEN" | signing-tool -c -t @- -a https://app.laavat.io/<CustomerName>/api/v1 product getall
  

• -t @/path/to/tokenfile — read the token from a file (the tool warns if the file is group/world-readable; use chmod 600):

  signing-tool -c -t @/run/secrets/jwt -a https://app.laavat.io/<CustomerName>/api/v1 product getall
  

In a configuration file, reference the token by file instead of inlining it (inlining is deprecated and warns on use):

[service]
url = https://app.laavat.io/<CustomerName>/api/v1
token_file = /run/secrets/jwt

These forms integrate cleanly with CI secret managers, which expose secrets as files or on stdin. TLS verification is on by default; --skipssl disables it and is intended for local development only.

A leading @ is interpreted as a stdin/file reference (the curl convention). OAuth2/JWT tokens never start with @, but if you ever need a literal token that does, escape it as \@token.

Recommended usage

Use a configuration file to keep credentials out of command history and logs. Create the file with config-init, then run the CLI using the -n option.

config-init -n test.ini -t "$TOKEN" -s -a https://app.laavat.io/<CustomerName>/api/v1
signing-tool -n test.ini product getall

Alternative usage

You can also pass settings directly on the command line, but this is less secure because tokens may become visible in shell history or process listings.

signing-tool -c -t "$TOKEN" -a https://app.laavat.io/<CustomerName>/api/v1 product getall

Configuration Options

Option 1: create an ini config file using config-init:

config-init -n test.ini -t "$TOKEN" -s -a https://app.laavat.io/<CustomerName>/api/v1
signing-tool -n test.ini product getall

Option 2: pass settings directly on the command line (not recommended for secrets):

signing-tool -c -t "$TOKEN" -a https://app.laavat.io/<CustomerName>/api/v1 product getall

Example Signing Commands

HAB image signing with config file:

signing-tool -n test.ini imagesigning add SignHABIMG -P <product-id> --operid <operator-id> -p <payload>

OCI signing with token and API address:

signing-tool -c -t "$TOKEN" -a https://app.laavat.io/<CustomerName>/api/v1 imagesigning add SignOCI -P <product-id> --operid <operator-id> -A <artifact>

Requirements

• Python 3.8 or newer
• SigningService — The signing-tool CLI depends on the SigningService API client library. This is automatically installed when you install signing-tool from PyPI

Packaging

This package is configured for PyPI distribution using pyproject.toml and setuptools. Read the pyproject.toml file for package metadata and published package configuration.