# kindgi exports

> Signed exports: check one (an audit bundle, provenance, compliance evidence)

## `kindgi exports`

**Synopsis**

```sh signature
kindgi exports <command>
```

Signed exports: check one (an audit bundle, provenance, compliance evidence).

**Commands**

| Command                                                                                                  | Description                                                                                                                                                                            |
| -------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [`kindgi exports verify`](https://docs.kindgi.com/v0.1.8/reference/cli/exports.md#kindgi-exports-verify) | Check a signed export (an approval's audit bundle, a run's provenance, compliance evidence): that its bytes are the ones signed, and, with --trust or --from-runtime, who signed them. |

**See also**

- [Export signed evidence](https://docs.kindgi.com/v0.1.8/guides/observability/export-signed-evidence.md)

### `kindgi exports verify`

**Synopsis**

```sh signature
kindgi exports verify <file> [--trust=<public-key.pem>]... [--from-runtime]
```

Check a signed export (an approval's audit bundle, a run's provenance, compliance evidence): that its bytes are the ones signed, and, with --trust or --from-runtime, who signed them. Exit 0 when it checks out, 1 when it doesn't.

**Options**

| Option            | Default                                         | Description                                                                    |
| ----------------- | ----------------------------------------------- | ------------------------------------------------------------------------------ |
| `--from-runtime`  | off                                             | Trust the keys the runtime signs exports with (`GET /v1/export-signing-keys`). |
| `--trust <value>` | none (checks against the export's own key only) | A public key file (PEM) you trust. Repeat for several. Repeatable.             |

Every command also takes the [global flags](https://docs.kindgi.com/v0.1.8/reference/cli.md#global-flags).

**Examples**

From [Export signed evidence](https://docs.kindgi.com/v0.1.8/guides/observability/export-signed-evidence.md):

```sh
pnpm exec kindgi exports verify approval.json --from-runtime
```

**See also**

- [Export signed evidence](https://docs.kindgi.com/v0.1.8/guides/observability/export-signed-evidence.md)
- [`kindgi exports`](https://docs.kindgi.com/v0.1.8/reference/cli/exports.md#kindgi-exports)