in-toto "link metadata verification failed" in CI
in-toto verifies that each step in your supply chain ran as declared, using signed link metadata. Verification fails when a link file is missing, signed by the wrong functionary key, or the artifact rules (MATCH/CREATE/DELETE) are not met.
What this error means
in-toto-verify raises "verification failed", "no signature found for keyid", or an artifact rule error such as "materials/products do not match" for a step.
in-toto-verify --layout root.layout --layout-keys owner.pub
(in-toto-verify) LinkNotFoundError: Could not find link metadata file for step 'build'
Verification failed.Common causes
Missing or misnamed link metadata
Each layout step expects a <step>.<keyid>.link file. If the step did not run, was not recorded, or the file name is wrong, verification cannot find it.
Wrong functionary key or a broken artifact rule
A link signed by an unexpected key, or products of one step that do not match the materials of the next, violates the layout rules.
How to fix it
Record every step with the expected key and name
- Wrap each build step with
in-toto-runso it emits signed link metadata. - Use the functionary keys the layout authorizes for those steps.
- Collect all
.linkfiles into the verify working directory.
in-toto-run --step-name build --key builder.key \
--materials . --products app/ -- make buildAlign artifact rules across steps
Ensure the products a step declares match the materials the next step consumes so MATCH rules pass during verification.
How to prevent it
- Emit signed link metadata for every layout step in CI.
- Keep functionary keys and step names consistent with the layout.
- Validate that step products match downstream materials.