{"action":"created","comment":{"url":"https://api.github.com/repos/in-toto/in-toto/pulls/comments/85813001","pull_request_review_id":6506649,"id":85813001,"diff_hunk":"@@ -0,0 +1,203 @@\n+# in-toto demo\n+\n+In this demo, we will use in-toto to secure a supply chain with a very simple\n+workflow.\n+Alice will be the project owner - she creates and signs the supply chain layout\n+with her private key - and Bob and Carl will be the project functionaries - they\n+carry out the steps of the supply chain as defined in the layout.\n+\n+For the sake of demonstrating in-toto, we will have you run all parts of the\n+supply chain.\n+This is, you will perform the commands on behalf of Alice, Bob and Carl as well\n+as the client who verifies the final product.\n+\n+\n+### Download and setup in-toto on *NIX (Linux, OS X, ..)\n+```shell\n+# Make sure you have git, python and pip installed on your system\n+# and get in-toto\n+git clone -b develop --recursive https://github.com/in-toto/in-toto.git\n+\n+# Change into project root directory\n+cd in-toto\n+\n+# Install required packages (we strongly recommend using Virtual Environments)\n+# http://docs.python-guide.org/en/latest/dev/virtualenvs/\n+pip install -r requirements.txt\n+\n+# Install additional requirements that for some good reason are not in the\n+# requirements file\n+pip install pycrypto cryptography\n+\n+# Make sure in-toto is on your PYTHONPATH and used commands are on your PATH\n+export PYTHONPATH=$PYTHONPATH:$PWD\n+export PATH=$PATH:$PWD/toto\n+\n+# Change into the demo directoy and you are ready to start\n+cd demo\n+```\n+Inside the demo directory you will find four directories: `owner_alice`,\n+`functionary_bob`, `functionary_carl` and `final_product`. Alice, Bob and Carl\n+already have RSA keys in each of their directories. This is what you see:\n+```shell\n+tree\n+# the tree command gives you the following output\n+# ├── README.md\n+# ├── final_product\n+# ├── functionary_bob\n+# │   ├── bob\n+# │   └── bob.pub\n+# ├── functionary_carl\n+# │   ├── carl\n+# │   └── carl.pub\n+# ├── owner_alice\n+# │   ├── alice\n+# │   └── alice.pub\n+# └── run-demo.py\n+```\n+\n+### Define supply chain layout (Alice)\n+First, we will need to define the supply chain layout. To simplify this process,\n+we provide a script that generates a simple layout for the purpose of the demo.\n+In this supply chain layout, we have Alice, who is the project owner that creates\n+the layout, Bob, who uses `vi` to create a Python program foo.py, and Carl, who\n+uses `tar` to package up `foo.py` into a tarball which together with the in-toto\n+metadata composes the final product that will eventually be installed and verified\n+by the end user.\n+\n+```shell\n+# Create and sign the supply chain layout on behalf of Alice\n+cd owner_alice\n+python create_layout.py\n+```\n+The script will create a layout, add Bob's and Carl's public keys (fetched from\n+their directories), sign it with Alice's private key and dump it to `root.layout`.\n+In `root.layout`, you will find that (besides the signature and other information)\n+there are two steps, `write_code` and `package`, that the functionaries Bob\n+and Carl, identified by their public keys, are authorized to perform.\n+\n+### Write code (Bob)\n+Now, we will take the role of the functionary Bob and perform the step\n+`write-code` on his behalf, that is we use in-toto to open an editor and record\n+metadata for what we do. Execute the following commands to change to Bob's\n+directory and perform the step.\n+\n+```shell\n+cd ../functionary_bob\n+toto-run.py --step-name write-code --products foo.py --key bob -- vi foo.py\n+# Bob has to send the resulting foo.py to Carl so that he can package it\n+cp foo.py ../functionary_carl/","path":"demo/README.md","position":89,"original_position":89,"commit_id":"51b4c7b6ab8081148d115fe86908aa8d806ed706","original_commit_id":"51b4c7b6ab8081148d115fe86908aa8d806ed706","user":{"login":"vladimir-v-diaz","id":3520883,"avatar_url":"https://avatars.githubusercontent.com/u/3520883?v=3","gravatar_id":"","url":"https://api.github.com/users/vladimir-v-diaz","html_url":"https://github.com/vladimir-v-diaz","followers_url":"https://api.github.com/users/vladimir-v-diaz/followers","following_url":"https://api.github.com/users/vladimir-v-diaz/following{/other_user}","gists_url":"https://api.github.com/users/vladimir-v-diaz/gists{/gist_id}","starred_url":"https://api.github.com/users/vladimir-v-diaz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vladimir-v-diaz/subscriptions","organizations_url":"https://api.github.com/users/vladimir-v-diaz/orgs","repos_url":"https://api.github.com/users/vladimir-v-diaz/repos","events_url":"https://api.github.com/users/vladimir-v-diaz/events{/privacy}","received_events_url":"https://api.github.com/users/vladimir-v-diaz/received_events","type":"User","site_admin":false},"body":"Or put a blank line between the two commands:\r\n\r\n```Python\r\ncd ../functionary_bob\r\ntoto-run.py --step-name write-code --products foo.py --key bob -- vi foo.py\r\n\r\n# Bob has to send the resulting foo.py to Carl so that he can package it\r\ncp foo.py ../functionary_carl/\r\n```","created_at":"2016-10-31T19:20:38Z","updated_at":"2016-10-31T19:20:38Z","html_url":"https://github.com/in-toto/in-toto/pull/28#discussion_r85813001","pull_request_url":"https://api.github.com/repos/in-toto/in-toto/pulls/28","_links":{"self":{"href":"https://api.github.com/repos/in-toto/in-toto/pulls/comments/85813001"},"html":{"href":"https://github.com/in-toto/in-toto/pull/28#discussion_r85813001"},"pull_request":{"href":"https://api.github.com/repos/in-toto/in-toto/pulls/28"}}},"pull_request":{"url":"https://api.github.com/repos/in-toto/in-toto/pulls/28","id":91458877,"html_url":"https://github.com/in-toto/in-toto/pull/28","diff_url":"https://github.com/in-toto/in-toto/pull/28.diff","patch_url":"https://github.com/in-toto/in-toto/pull/28.patch","issue_url":"https://api.github.com/repos/in-toto/in-toto/issues/28","number":28,"state":"open","locked":false,"title":"Adds demo setup and instructions","user":{"login":"lukpueh","id":589324,"avatar_url":"https://avatars.githubusercontent.com/u/589324?v=3","gravatar_id":"","url":"https://api.github.com/users/lukpueh","html_url":"https://github.com/lukpueh","followers_url":"https://api.github.com/users/lukpueh/followers","following_url":"https://api.github.com/users/lukpueh/following{/other_user}","gists_url":"https://api.github.com/users/lukpueh/gists{/gist_id}","starred_url":"https://api.github.com/users/lukpueh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lukpueh/subscriptions","organizations_url":"https://api.github.com/users/lukpueh/orgs","repos_url":"https://api.github.com/users/lukpueh/repos","events_url":"https://api.github.com/users/lukpueh/events{/privacy}","received_events_url":"https://api.github.com/users/lukpueh/received_events","type":"User","site_admin":false},"body":"Adds a demo directory with project owner and functionary keys and instructions on how to download and install in-toto and go through a simple software supply chain. This should replace the previous demo instructions that required the user to download a linux VM.\n","created_at":"2016-10-28T21:55:07Z","updated_at":"2016-10-31T19:20:38Z","closed_at":null,"merged_at":null,"merge_commit_sha":"0d9693620856758a730a3da8da42f1658b9bcd20","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/in-toto/in-toto/pulls/28/commits","review_comments_url":"https://api.github.com/repos/in-toto/in-toto/pulls/28/comments","review_comment_url":"https://api.github.com/repos/in-toto/in-toto/pulls/comments{/number}","comments_url":"https://api.github.com/repos/in-toto/in-toto/issues/28/comments","statuses_url":"https://api.github.com/repos/in-toto/in-toto/statuses/51b4c7b6ab8081148d115fe86908aa8d806ed706","head":{"label":"in-toto:add-demo","ref":"add-demo","sha":"51b4c7b6ab8081148d115fe86908aa8d806ed706","user":{"login":"in-toto","id":22891761,"avatar_url":"https://avatars.githubusercontent.com/u/22891761?v=3","gravatar_id":"","url":"https://api.github.com/users/in-toto","html_url":"https://github.com/in-toto","followers_url":"https://api.github.com/users/in-toto/followers","following_url":"https://api.github.com/users/in-toto/following{/other_user}","gists_url":"https://api.github.com/users/in-toto/gists{/gist_id}","starred_url":"https://api.github.com/users/in-toto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/in-toto/subscriptions","organizations_url":"https://api.github.com/users/in-toto/orgs","repos_url":"https://api.github.com/users/in-toto/repos","events_url":"https://api.github.com/users/in-toto/events{/privacy}","received_events_url":"https://api.github.com/users/in-toto/received_events","type":"Organization","site_admin":false},"repo":{"id":59531400,"name":"in-toto","full_name":"in-toto/in-toto","owner":{"login":"in-toto","id":22891761,"avatar_url":"https://avatars.githubusercontent.com/u/22891761?v=3","gravatar_id":"","url":"https://api.github.com/users/in-toto","html_url":"https://github.com/in-toto","followers_url":"https://api.github.com/users/in-toto/followers","following_url":"https://api.github.com/users/in-toto/following{/other_user}","gists_url":"https://api.github.com/users/in-toto/gists{/gist_id}","starred_url":"https://api.github.com/users/in-toto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/in-toto/subscriptions","organizations_url":"https://api.github.com/users/in-toto/orgs","repos_url":"https://api.github.com/users/in-toto/repos","events_url":"https://api.github.com/users/in-toto/events{/privacy}","received_events_url":"https://api.github.com/users/in-toto/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/in-toto/in-toto","description":"Toto is a framework to protect supply chain integrity.","fork":false,"url":"https://api.github.com/repos/in-toto/in-toto","forks_url":"https://api.github.com/repos/in-toto/in-toto/forks","keys_url":"https://api.github.com/repos/in-toto/in-toto/keys{/key_id}","collaborators_url":"https://api.github.com/repos/in-toto/in-toto/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/in-toto/in-toto/teams","hooks_url":"https://api.github.com/repos/in-toto/in-toto/hooks","issue_events_url":"https://api.github.com/repos/in-toto/in-toto/issues/events{/number}","events_url":"https://api.github.com/repos/in-toto/in-toto/events","assignees_url":"https://api.github.com/repos/in-toto/in-toto/assignees{/user}","branches_url":"https://api.github.com/repos/in-toto/in-toto/branches{/branch}","tags_url":"https://api.github.com/repos/in-toto/in-toto/tags","blobs_url":"https://api.github.com/repos/in-toto/in-toto/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/in-toto/in-toto/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/in-toto/in-toto/git/refs{/sha}","trees_url":"https://api.github.com/repos/in-toto/in-toto/git/trees{/sha}","statuses_url":"https://api.github.com/repos/in-toto/in-toto/statuses/{sha}","languages_url":"https://api.github.com/repos/in-toto/in-toto/languages","stargazers_url":"https://api.github.com/repos/in-toto/in-toto/stargazers","contributors_url":"https://api.github.com/repos/in-toto/in-toto/contributors","subscribers_url":"https://api.github.com/repos/in-toto/in-toto/subscribers","subscription_url":"https://api.github.com/repos/in-toto/in-toto/subscription","commits_url":"https://api.github.com/repos/in-toto/in-toto/commits{/sha}","git_commits_url":"https://api.github.com/repos/in-toto/in-toto/git/commits{/sha}","comments_url":"https://api.github.com/repos/in-toto/in-toto/comments{/number}","issue_comment_url":"https://api.github.com/repos/in-toto/in-toto/issues/comments{/number}","contents_url":"https://api.github.com/repos/in-toto/in-toto/contents/{+path}","compare_url":"https://api.github.com/repos/in-toto/in-toto/compare/{base}...{head}","merges_url":"https://api.github.com/repos/in-toto/in-toto/merges","archive_url":"https://api.github.com/repos/in-toto/in-toto/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/in-toto/in-toto/downloads","issues_url":"https://api.github.com/repos/in-toto/in-toto/issues{/number}","pulls_url":"https://api.github.com/repos/in-toto/in-toto/pulls{/number}","milestones_url":"https://api.github.com/repos/in-toto/in-toto/milestones{/number}","notifications_url":"https://api.github.com/repos/in-toto/in-toto/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/in-toto/in-toto/labels{/name}","releases_url":"https://api.github.com/repos/in-toto/in-toto/releases{/id}","deployments_url":"https://api.github.com/repos/in-toto/in-toto/deployments","created_at":"2016-05-24T01:46:38Z","updated_at":"2016-10-28T16:54:56Z","pushed_at":"2016-10-31T19:16:40Z","git_url":"git://github.com/in-toto/in-toto.git","ssh_url":"git@github.com:in-toto/in-toto.git","clone_url":"https://github.com/in-toto/in-toto.git","svn_url":"https://github.com/in-toto/in-toto","homepage":"","size":245,"stargazers_count":1,"watchers_count":1,"language":"Python","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":2,"mirror_url":null,"open_issues_count":22,"forks":2,"open_issues":22,"watchers":1,"default_branch":"master"}},"base":{"label":"in-toto:expire","ref":"expire","sha":"614fb502cc906c8e3c3f73cba5f95fe2083ed506","user":{"login":"in-toto","id":22891761,"avatar_url":"https://avatars.githubusercontent.com/u/22891761?v=3","gravatar_id":"","url":"https://api.github.com/users/in-toto","html_url":"https://github.com/in-toto","followers_url":"https://api.github.com/users/in-toto/followers","following_url":"https://api.github.com/users/in-toto/following{/other_user}","gists_url":"https://api.github.com/users/in-toto/gists{/gist_id}","starred_url":"https://api.github.com/users/in-toto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/in-toto/subscriptions","organizations_url":"https://api.github.com/users/in-toto/orgs","repos_url":"https://api.github.com/users/in-toto/repos","events_url":"https://api.github.com/users/in-toto/events{/privacy}","received_events_url":"https://api.github.com/users/in-toto/received_events","type":"Organization","site_admin":false},"repo":{"id":59531400,"name":"in-toto","full_name":"in-toto/in-toto","owner":{"login":"in-toto","id":22891761,"avatar_url":"https://avatars.githubusercontent.com/u/22891761?v=3","gravatar_id":"","url":"https://api.github.com/users/in-toto","html_url":"https://github.com/in-toto","followers_url":"https://api.github.com/users/in-toto/followers","following_url":"https://api.github.com/users/in-toto/following{/other_user}","gists_url":"https://api.github.com/users/in-toto/gists{/gist_id}","starred_url":"https://api.github.com/users/in-toto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/in-toto/subscriptions","organizations_url":"https://api.github.com/users/in-toto/orgs","repos_url":"https://api.github.com/users/in-toto/repos","events_url":"https://api.github.com/users/in-toto/events{/privacy}","received_events_url":"https://api.github.com/users/in-toto/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/in-toto/in-toto","description":"Toto is a framework to protect supply chain integrity.","fork":false,"url":"https://api.github.com/repos/in-toto/in-toto","forks_url":"https://api.github.com/repos/in-toto/in-toto/forks","keys_url":"https://api.github.com/repos/in-toto/in-toto/keys{/key_id}","collaborators_url":"https://api.github.com/repos/in-toto/in-toto/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/in-toto/in-toto/teams","hooks_url":"https://api.github.com/repos/in-toto/in-toto/hooks","issue_events_url":"https://api.github.com/repos/in-toto/in-toto/issues/events{/number}","events_url":"https://api.github.com/repos/in-toto/in-toto/events","assignees_url":"https://api.github.com/repos/in-toto/in-toto/assignees{/user}","branches_url":"https://api.github.com/repos/in-toto/in-toto/branches{/branch}","tags_url":"https://api.github.com/repos/in-toto/in-toto/tags","blobs_url":"https://api.github.com/repos/in-toto/in-toto/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/in-toto/in-toto/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/in-toto/in-toto/git/refs{/sha}","trees_url":"https://api.github.com/repos/in-toto/in-toto/git/trees{/sha}","statuses_url":"https://api.github.com/repos/in-toto/in-toto/statuses/{sha}","languages_url":"https://api.github.com/repos/in-toto/in-toto/languages","stargazers_url":"https://api.github.com/repos/in-toto/in-toto/stargazers","contributors_url":"https://api.github.com/repos/in-toto/in-toto/contributors","subscribers_url":"https://api.github.com/repos/in-toto/in-toto/subscribers","subscription_url":"https://api.github.com/repos/in-toto/in-toto/subscription","commits_url":"https://api.github.com/repos/in-toto/in-toto/commits{/sha}","git_commits_url":"https://api.github.com/repos/in-toto/in-toto/git/commits{/sha}","comments_url":"https://api.github.com/repos/in-toto/in-toto/comments{/number}","issue_comment_url":"https://api.github.com/repos/in-toto/in-toto/issues/comments{/number}","contents_url":"https://api.github.com/repos/in-toto/in-toto/contents/{+path}","compare_url":"https://api.github.com/repos/in-toto/in-toto/compare/{base}...{head}","merges_url":"https://api.github.com/repos/in-toto/in-toto/merges","archive_url":"https://api.github.com/repos/in-toto/in-toto/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/in-toto/in-toto/downloads","issues_url":"https://api.github.com/repos/in-toto/in-toto/issues{/number}","pulls_url":"https://api.github.com/repos/in-toto/in-toto/pulls{/number}","milestones_url":"https://api.github.com/repos/in-toto/in-toto/milestones{/number}","notifications_url":"https://api.github.com/repos/in-toto/in-toto/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/in-toto/in-toto/labels{/name}","releases_url":"https://api.github.com/repos/in-toto/in-toto/releases{/id}","deployments_url":"https://api.github.com/repos/in-toto/in-toto/deployments","created_at":"2016-05-24T01:46:38Z","updated_at":"2016-10-28T16:54:56Z","pushed_at":"2016-10-31T19:16:40Z","git_url":"git://github.com/in-toto/in-toto.git","ssh_url":"git@github.com:in-toto/in-toto.git","clone_url":"https://github.com/in-toto/in-toto.git","svn_url":"https://github.com/in-toto/in-toto","homepage":"","size":245,"stargazers_count":1,"watchers_count":1,"language":"Python","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":2,"mirror_url":null,"open_issues_count":22,"forks":2,"open_issues":22,"watchers":1,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/in-toto/in-toto/pulls/28"},"html":{"href":"https://github.com/in-toto/in-toto/pull/28"},"issue":{"href":"https://api.github.com/repos/in-toto/in-toto/issues/28"},"comments":{"href":"https://api.github.com/repos/in-toto/in-toto/issues/28/comments"},"review_comments":{"href":"https://api.github.com/repos/in-toto/in-toto/pulls/28/comments"},"review_comment":{"href":"https://api.github.com/repos/in-toto/in-toto/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/in-toto/in-toto/pulls/28/commits"},"statuses":{"href":"https://api.github.com/repos/in-toto/in-toto/statuses/51b4c7b6ab8081148d115fe86908aa8d806ed706"}}}}
{"actor":{"display_login":"vladimir-v-diaz"}}