kindgi exports
kindgi exports
Section titled “kindgi exports”Synopsis
kindgi exports <command>Signature
Signed exports: check one (an audit bundle, provenance, compliance evidence).
Commands
| Command | Description |
|---|---|
kindgi exports verify |
Check a signed export (an approval's audit bundle, a run's provenance, compliance evidence): that its bytes are the ones signed, and, with --trust or --from-runtime, who signed them. |
See also
kindgi exports verify
Section titled “kindgi exports verify”Synopsis
kindgi exports verify <file> [--trust=<public-key.pem>]... [--from-runtime]Signature
Check a signed export (an approval's audit bundle, a run's provenance, compliance evidence): that its bytes are the ones signed, and, with --trust or --from-runtime, who signed them. Exit 0 when it checks out, 1 when it doesn't.
Options
| Option | Default | Description |
|---|---|---|
--from-runtime |
off | Trust the keys the runtime signs exports with (GET /v1/export-signing-keys). |
--trust <value> |
none (checks against the export's own key only) | A public key file (PEM) you trust. Repeat for several. Repeatable. |
Every command also takes the global flags.
Examples
From Export signed evidence:
pnpm exec kindgi exports verify approval.json --from-runtimeSee also