Skip to main content

Manage attestations with SMCTL

The smctl attest command group provides enterprise-grade attestation signing, verification, and inspection for software supply chain evidence. It creates cryptographically signed attestations using in-toto Statements wrapped in DSSE (Dead Simple Signing Envelope) format, signed using DigiCert​​®​​ Software Trust Manager keypairs.

This enables customers to:

  • Sign any type of supply chain evidence, including SBOMs, vulnerability reports, build provenance, and scan results, through a single, unified command.

  • Verify attestations offline using public keys or certificates, with no network connectivity required.

  • Inspect attestation contents independently of signature verification.

  • Generate artifacts that are natively compatible with Cosign.

Before you begin

Before you begin, ensure that prerequisites have been completedy:

  • Software Trust Manager authentication (required for attest sign only- Set the required environment variables before running any commands.

  • (Optional) Cosign-for cross-tool verification. Install using brew install cosign.

Supported key algorithms

Algorithm

Key sizes

RSA

3072, 4096

ECDSA

P-256, P-384

Supported evidence types

CLI --type value

Evidence format

Default predicate type URI

Auto-detectable

cyclonedx

CycloneDX SBOM

https://cyclonedx.org/bom

Yes

spdx

SPDX SBOM

https://spdx.dev/Document

Yes

sarif

SARIF scan results

https://attestations.digicert.com/sarif/v1

Yes

slsa-provenance

SLSA build provenance

https://slsa.dev/provenance/v1

Yes

vex

OpenVEX vulnerability exchange

https://openvex.dev/ns

Yes

verification-receipt

Policy verification receipt

https://attestations.digicert.com/verification-receipt/v1

No

scan-results

Security scan/test results

https://attestations.digicert.com/scan-results/v1

No

CLI aliases:

Type

Alias

cdx

cyclonedx

sbom

cyclonedx

slsa

slsa-provenance

Attest using SMCTL

Use smctl attest sign to create a signed attestation for supply chain evidence.

smctl attest sign --type <type> --input <file> --keypair-alias <alias> [--output <file>]

Required parameters

Parameter

Short form

Description

--input

-i

Path to the evidence JSON file

--keypair-alias

-k

Software Trust Manager keypair alias (as shown in smctl keypair ls)

Optional parameters

Parameter

Description

Default

--type

Evidence type: cyclonedx, spdx, sarif, slsa-provenance, vex, verification-receipt, scan-results.

Auto-detected from file content

--output

Output file path for the DSSE envelope

stdout

--embed

Embed full evidence in the attestation

true

--reference

Reference mode: store evidence separately, only digest in attestation

false

--subject-name

Override the artifact name in the attestation subject

Evidence filename

--subject-digest

Pre-computed SHA-256 digest of the artifact being attested

Auto-computed from input file

--oci-ref

Push attestation to an OCI registry as a referrer

-

Example:

# Sign a CycloneDX SBOM
smctl attest sign --type cyclonedx -i sbom.json -k my-signing-key --output attestation.json

# Auto-detect evidence type
smctl attest sign -i sbom.json -k my-signing-key --output attestation.json

# Sign with explicit subject binding (attestation is about a container image)
smctl attest sign --type cyclonedx -i sbom.json -k my-signing-key \
  --subject-name myapp:v1.0 \
  --subject-digest 7d865e959b2466918c9863afca942d0fb89d7c9ac0c99bafc3749504ded97730 \
  --output attestation.json

# Reference mode (for large evidence files)
smctl attest sign --type cyclonedx --reference -i large-sbom.json -k my-signing-key --output attestation.json

Verify attestation

Use smctl attest verify to verify the cryptographic signature on a DSSE attestation envelope.

smctl attest verify --attestation-file <file> --public-key <key.pem>
smctl attest verify --attestation-file <file> --certificate <cert.pem> [--ca-bundle <ca.pem>]

Parameters

Parameter

Description

--attestation-file

Path to the DSSE attestation envelope JSON file (required)

--public-key

PEM-encoded public key file (mutually exclusive with --certificate)

--certificate

PEM-encoded certificate file (mutually exclusive with --public-key)

--ca-bundlec

PEM-encoded CA bundle for certificate chain validation (requires --certificate)

Example:

# Verify with a public key
smctl attest verify --attestation-file attestation.json --public-key signing-key.pem

# Verify with a certificate
smctl attest verify --attestation-file attestation.json --certificate signing-cert.pem

# Verify with certificate + CA chain validation
smctl attest verify --attestation-file attestation.json --certificate signing-cert.pem --ca-bundle ca-bundle.pem

Output:

Signature: VALID

Inspect contents of an attestation envelope

Use smctl attest inspect to decodes and display the contents of a DSSE attestation envelope without performing signature verification.

smctl attest inspect --attestation-file <file>

Required parameters:

Parameter

Description

--attestation-file

Path to the DSSE attestation envelope JSON file.

Example:

smctl attest inspect --attestation-file attestation.json

Output (abbreviated)

{
  "payloadType": "application/vnd.in-toto+json",
  "statementType": "https://in-toto.io/Statement/v1",
  "predicateType": "https://cyclonedx.org/bom",
  "subjects": [
    {
      "name": "sbom.json",
      "digest": {
        "sha256": "75f28e32da932773683e9b867990abc10b59ef6492aefdec9d900c9ef7622d74"
      }
    }
  ],
  "signatures": [
    {
      "keyid": "49e9144a448701cb028b6f095fb4bfec0bbf6aee7d6869142e3010585df49760"
    }
  ],
  "predicate": { ... full evidence content ... }
}

Embedded versus reference mode

Support for cosign attestations

Attestations produced by smctl attest sign are natively verifiable by cosign, the standard Sigstore verification tool. No DigiCert-specific plugins or configuration are required.

# Sign with smctl
smctl attest sign --type cyclonedx -i sbom.json -k my-key --output attestation.json

# Verify with stock cosign
cosign verify-blob-attestation \
  --signature attestation.json \
  --key signing-key.pem \
  --check-claims=false \
  --type "https://cyclonedx.org/bom" \
  --insecure-ignore-tlog \
  --sbom.json
In this section: