Commands / kosa8 snapshot seal
kosa8 snapshot seal
Sign a tamper-evident record of exactly what a snapshot contains
Usage
kosa8 seal SNAPSHOT --reason TEXT
Hashes every file of the snapshot (SHA-256), signs the list with an Ed25519 key
together with who signed, when, why and the audit log's current head, and
stores the result as seal.json beside the snapshot. The seal is recorded in
the audit log. From then on every restore verifies it first, and
kosa8 snapshot verify names any file that has changed.
--reason is the meaning of the signature ("approved: validated state for batch 42", "evidence as received"); it is part of what is signed.
Without --signer-key the machine's own key (~/.kosa8/seal.key) signs: that
attests the machine, not a person. For a personal signature make a key with
kosa8 policy keygen --out FILE and pass --signer-key FILE.
Options
| Flag | Type | What it does | Default |
|---|---|---|---|
--reason | string | what the signature means (required; part of the signed record) | — |
--signer | string | the signer's printed name (default: the current OS user) | — |
--signer-key | string | Ed25519 private key file, as kosa8 policy keygen --out writes (default: this machine's key) | — |