Introduction

signing-tool is the reference client for the LAAVAT PKI and Signing Platform. It is a Python command-line tool that implements the main use cases — image signing, product and PKI management, encryption key export, and device certificate issuance — and can be used directly or as a reference for your own integration.

The client wraps a generated API client (from the platform's OpenAPI specification) behind a task-oriented command-line interface. It is usable interactively and from CI/build systems (see Usage for exit codes, --json, and the automation flow).

The documentation reflects signing-tool v3.9.0 and later. You are responsible for evaluating its suitability and security for your own production environment before relying on it.

Getting the client

Install from PyPI:

pip install signing-tool

Releases are published with PEP 740 digital attestations signed via Sigstore, so you can verify a downloaded artifact was built and published by LAAVAT's official pipeline. See Setup for installation and verification.