kindgi exports

`kindgi exports`

Synopsis

kindgi exports <command>

Signature

Exports: create an export of the whole workspace as files, or verify a signed one.

Commands

Command	Description
`kindgi exports create`	Export the whole workspace as files: every kind of record the API reads, one JSON line per record, as the API answers it, and the signed exports (each decided approval's audit bundle, each run's provenance, the compliance evidence).
`kindgi exports verify`	Check a signed export (an approval's audit bundle, a run's provenance, compliance evidence): that its bytes are the ones signed, and, with --trust or --from-runtime, who signed them.

See also

Export signed evidence

`kindgi exports create`

Synopsis

kindgi exports create --out <dir> [--resume] [--no-signed] [--yes]

Signature

Export the whole workspace as files: every kind of record the API reads, one JSON line per record, as the API answers it, and the signed exports (each decided approval's audit bundle, each run's provenance, the compliance evidence). Run it as a tenant admin. manifest.json says what each file holds. Exit 0 when every kind is exported or skipped, 1 when any failed.

Options

Option	Default	Description
`--no-signed`	off	Don't make the signed exports: fewer requests, and no `export-signed` audit events.
`--out <value>`	required: a new or empty folder, or, with `--resume`, the folder an export stopped in	The folder to write the export to: a new or empty one, or, with --resume, one an export stopped in.
`--resume`	off	Finish the export in --out: the kinds its manifest.json marks ok are kept, and the rest are read again.
`--yes`	off	Export as someone who isn't a tenant admin: the kinds only a tenant admin reads are skipped.

Every command also takes the global flags.

Examples

Export the whole workspace to a new folder, as a tenant admin.

kindgi exports create --out ./acme-export

Finish an export that stopped part way: the kinds already written are kept.

kindgi exports create --out ./acme-export --resume

See also

`kindgi exports verify`

Synopsis

kindgi exports verify <file> [--trust=<public-key.pem>]... [--from-runtime]

Signature

Check a signed export (an approval's audit bundle, a run's provenance, compliance evidence): that its bytes are the ones signed, and, with --trust or --from-runtime, who signed them. Exit 0 when it checks out, 1 when it doesn't.

Options

Option	Default	Description
`--from-runtime`	off	Trust the keys the runtime signs exports with (`GET /v1/export-signing-keys`).
`--trust <value>`	none (checks against the export's own key only)	A public key file (PEM) you trust. Repeat for several. Repeatable.

Every command also takes the global flags.

Examples

From Export signed evidence:

pnpm exec kindgi exports verify approval.json --from-runtime

See also