Setup¶

Python 3.8 or newer is required.

Install from PyPI (recommended)¶

python3 -m venv .venv
source .venv/bin/activate
pip install signing-tool
signing-tool --version

This installs the signing-tool and config-init commands.

Verifying the download¶

Releases are published on PyPI with PEP 740 digital attestations signed via Sigstore — verifiable proof that an artifact was built and published by LAAVAT's official pipeline. To verify a downloaded artifact:

pip install pypi-attestations
python3 -m pypi_attestations verify pypi \
    --repository https://gitlab.com/laavat/laavat-product/architecture/dist \
    pypi:signing_tool-<version>-py3-none-any.whl

A successful verification confirms provenance (who built it, from which repository). It is not a substitute for your own security review of the code.

Install from the release archive¶

If you received the reference client as a release archive instead:

unzip LAAVAT-reference-client-vx.x.x.zip
cd LAAVAT-reference-client-vx.x.x
make install
source clients/python3/.venv/bin/activate
signing-tool --version