bundle

Documentation

Overview

Command bundle is the CLI bridge to the BlakBox bundle crypto core.

It is the tool the offline update chain (and, later, the companion exporter and signed egress) shell out to so that every artifact crossing the air gap is signed and verified through ONE library — the same ECDSA-P384-over-DSSE / in-toto attestation the whole product is built on. It replaces the ad-hoc `openssl pkeyutl` Ed25519 detached signatures the update chain used before.

Three subcommands:

bundle keygen  -out-dir DIR -name NAME
    Generate a P-384 release keypair: NAME.key (PKCS#8 PEM, 0400),
    NAME.pub (SPKI PEM), NAME.fingerprint (the trust identity, printed
    on the manifest sheet and read out-of-band to customers).

bundle attest  -key KEY.pem -artifact FILE [-predicate manifest.json]
               [-predicate-type TYPE] [-subject-name NAME] -out ENV.json
    Produce an in-toto v1 Statement whose subject is the SHA-384 digest
    of FILE, sign it into a DSSE envelope with the P-384 key, write ENV.json.

bundle verify  -anchor PUB.pem [-anchor PUB2.pem ...] -artifact FILE
               -in ENV.json [-predicate-type TYPE] [-subject-name NAME]
    Verify the DSSE envelope against the PINNED anchor key(s), then RE-BIND:
    recompute SHA-384(FILE) and require it to equal the signed subject
    digest. A good signature over a statement that describes a DIFFERENT
    artifact is rejected. Exit 0 = good, 1 = verification FAILED, 2 = usage.

Every algorithm on the verify path (ECDSA P-384, SHA-384) is in the FIPS 140-3 validated Go module; build with GOFIPS140=v1.0.0 for the appliance.