github.com/in-toto/in-toto-golang@v0.9.1-0.20240517212500-990269f763cf/doc/in-toto_run.md (about)

     1  ## in-toto run
     2  
     3  Executes the passed command and records paths and hashes of 'materials'
     4  
     5  ### Synopsis
     6  
     7  Executes the passed command and records paths and hashes of 'materials' (i.e.
     8  files before command execution) and 'products' (i.e. files after command
     9  execution) and stores them together with other information (executed command,
    10  return value, stdout, stderr, ...) to a link metadata file, which is signed
    11  with the passed key.  Returns nonzero value on failure and zero otherwise.
    12  
    13  ```
    14  in-toto run [flags]
    15  ```
    16  
    17  ### Options
    18  
    19  ```
    20    -c, --cert string                       Path to a PEM formatted certificate that corresponds with
    21                                            the provided key.
    22    -e, --exclude stringArray               Path patterns to match paths that should not be recorded as 0
    23                                            ‘materials’ or ‘products’. Passed patterns override patterns defined
    24                                            in environment variables or config files. See Config docs for details.
    25        --follow-symlink-dirs               Follow symlinked directories to their targets. Note: this parameter
    26                                            toggles following linked directories only, linked files are always
    27                                            recorded independently of this parameter.
    28    -h, --help                              help for run
    29    -k, --key string                        Path to a PEM formatted private key file used to sign
    30                                            the resulting link metadata.
    31    -l, --lstrip-paths stringArray          Path prefixes used to left-strip artifact paths before storing
    32                                            them to the resulting link metadata. If multiple prefixes
    33                                            are specified, only a single prefix can match the path of
    34                                            any artifact and that is then left-stripped. All prefixes
    35                                            are checked to ensure none of them are a left substring
    36                                            of another.
    37    -m, --materials stringArray             Paths to files or directories, whose paths and hashes
    38                                            are stored in the resulting link metadata before the
    39                                            command is executed. Symlinks are followed.
    40    -d, --metadata-directory string         Directory to store link metadata (default "./")
    41    -n, --name string                       Name used to associate the resulting link metadata
    42                                            with the corresponding step defined in an in-toto layout.
    43    -x, --no-command                        Indicate that there is no command to be executed for the step.
    44        --normalize-line-endings            Enable line normalization in order to support different
    45                                            operating systems. It is done by replacing all line separators
    46                                            with a new line character.
    47    -p, --products stringArray              Paths to files or directories, whose paths and hashes
    48                                            are stored in the resulting link metadata after the
    49                                            command is executed. Symlinks are followed.
    50    -r, --run-dir string                    runDir specifies the working directory of the command.
    51                                            If runDir is the empty string, the command will run in the
    52                                            calling process's current directory. The runDir directory must
    53                                            exist, be writable, and not be a symlink.
    54        --spiffe-workload-api-path string   UDS path for SPIFFE workload API
    55        --use-dsse                          Create metadata using DSSE instead of the legacy signature wrapper.
    56  ```
    57  
    58  ### SEE ALSO
    59  
    60  * [in-toto](in-toto.md)	 - Framework to secure integrity of software supply chains
    61