Skip to content
NOQTIS

noqtis-export(1)

noqtis-export — a capsule as in-toto, DSSE, RO-Crate or BagIt

noqtis export --as intoto | dsse | rocrate | bagit [-k key] [-p key.pub] [-o file | dir] [-f] dir

noqtis export describes the capsule dir (noqtis-capsule(5)) in a format other tools read. The capsule must check first, with the key in its seal (noqtis-check(1)); pin the key there with -p before exporting.

An in-toto Statement v1 (JSON): one subject per file, with its path and SHA-256, and a predicate of type https://rootcoder007.github.io/noqtis/spec/capsule/ holding the capsule's id, format, algorithm, key fingerprint, created time and meta.
That statement in a DSSE envelope (‘application/vnd.in-toto+json’), signed with -k over the envelope's PAE. Most DSSE tools do not verify post-quantum signatures; noqtis-verify(1) --dsse does.
RO-Crate 1.1 metadata (ro-crate-metadata.json): the folder as a Dataset whose identifier is the capsule's id, each file with its size and SHA-256, the seal and the manifest as files. Put it beside the capsule's files to make the folder a crate; it is not listed in the manifest, so ‘noqtis check’ then reports it as an ‘extra’ file unless the folder is sealed again.
A BagIt 1.0 bag (RFC 8493) in the new folder -o: a copy of every file under data/, each checked against the manifest's SHA-256 as it is copied, its manifest-sha256.txt, bag-info.txt (the capsule's id as External-Identifier, Payload-Oxum), bagit.txt, and the seal and the manifest as tag files listed in tagmanifest-sha256.txt.
format
The format, as above.
key, --key=key
For dsse: the secret signature key.
key.pub, --pub=key.pub
Its public key. Default: key.pub.
file, --out=file
Write to file instead of standard output; for bagit, the bag's folder, which must not exist.
, --force
Replace file if it exists.

0
Exported.
1
The capsule does not check.
2
A usage error, a key that cannot be read, a file that changed while it was copied, or a file or folder that cannot be written.

$ noqtis export --as dsse -k me -o results.intoto.json results
$ noqtis verify -p me.pub --dsse results.intoto.json
$ noqtis export --as bagit -o results-bag results

noqtis(1), noqtis-check(1), noqtis-verify(1), nqdsse(3), noqtis-capsule(5)

in-toto Attestation Framework: Statement v1, https://github.com/in-toto/attestation/blob/main/spec/v1/statement.md. DSSE: Dead Simple Signing Envelope, https://github.com/secure-systems-lab/dsse/blob/master/envelope.md. RO-Crate 1.1, https://w3id.org/ro/crate/1.1. The BagIt File Packaging Format (V1.0), RFC 8493, October 2018.