NAME¶

sigsum-submit - create and/or submit add-leaf requests

SYNOPSIS¶

sigsum-submit [--diagnostics level] [--help] [-k file] [--leaf-hash] [-o file] [--output-dir directory] [-p file] [--raw-hash] [--timeout duration] [--token-domain value] [--token-signing-key file] [input files]

DESCRIPTION¶

--diagnostics=level

One of "fatal", "error", "warning", "info", or "debug" [info]

--help

Display help

-k, --signing-key=file

Key for signing the leaf

--leaf-hash

Output leaf hash

-o file

Write output to file, instead of stdout

--output-dir=directory

Directory for output files

-p, --policy=file

Sigsum policy

--raw-hash

Input is already hashed

--timeout=duration

Per-log submission timeout. Zero means library default, currently 45s

--token-domain=value

Create a Sigsum-Token: header for this domain

--token-signing-key=file

Key for signing Sigsum-Token: header

Create and/or submit add-leaf request(s).

If no input files are listed on the command line, a single request is processed, reading from standard input, and writing to standard output (or file specified with the -o option). See further below for processing of multiple files.

If a signing key (-k option) is specified, a new request is created by signing the the SHA256 hash of the input (or, if --raw-hash is given, input is the hash value, either exactly 32 octets, or a hex string). The key file uses openssh format, it must be either an unencrypted private key, or a public key, in which case the corresponding private key is accessed via ssh-agent.

If no signing key is provided, input should instead be the body of an add-leaf request, which is parsed and verified.

If a Sigsum policy (-p option) is provided, the request is submitted to the log specified by the policy, and a Sigsum proof is collected and output. If there are multiple logs in the policy, they are tried in randomized order.

With -k but without -p, the add-leaf request itself is output. With no -k and no -p, the request syntax and signature of the input request are verified, but there is no output.

The --leaf-hash option can be used to output the hash of the resulting leaf, instead of submitting it.

If input files are provided on the command line, each file corresponds to one request, and result is written to a corresponding output file, based on these rules:

1. If there's exactly one input file, and the -o option is used,

output is written to that file. Any existing file is overwritten.

2. For a request output, the suffix ".req" is added to the input

file name.

3. For a proof output, if the input is a request, any ".req"

suffix on the input file name is stripped. Then the suffix ".proof" is added.

4. If the --output-dir option is provided, any directory part of

the input file name is stripped, and the output is written as a file in the specified output directory.

If a corresponding .proof file already exists, that proof is read and verified. If the proof is valid, the input file is skipped. If the proof is not valid, sigsum-submit exits with an error.

If a corresponding .req output file already exists, it is overwritten (TODO: Figure out if that is the proper behavior).