# kosa8 validate iq

Generate an Installation Qualification record

## Usage

```
kosa8 iq SANDBOX|SNAPSHOT
```

Records, from the environment itself, what is installed and how it is
configured: kosa8's version and build provenance, the FIPS module state,
the guest kernel and root filesystem by SHA-256, every image in the sandbox
by content digest, each image's installed packages from its own package
database, the egress policy the host enforces, host mounts, labels, the
snapshot's seal, and `doctor --compliance`. Each item has an acceptance
criterion, the observed value, and PASS or FAIL; each failure is a numbered
deviation.

A SNAPSHOT is qualified in a clone restored from it and removed afterwards,
so the validated state itself is never booted into. A SANDBOX is queried as
it runs (listing packages starts short-lived containers in it).

--baseline takes an earlier, approved IQ: each item's expected value becomes
what that record observed, so a re-qualification fails on any change.

## Flags

| Flag | Type | What it does | Default |
|---|---|---|---|
| `--baseline` | string | an earlier IQ record whose observations become this record's expected values |  |
| `--baseline-key` | string | the public key the baseline must be signed with |  |
| `--html` | bool | also render RECORD.html |  |
| `--no-compliance` | bool | leave the host hardening controls (doctor --compliance) out of scope |  |
| `--no-packages` | bool | do not list installed packages inside the images |  |
| `--out, -o` | string | record package: .tar for a tar, else a directory (default <RECORD-ID>.tar) |  |
| `--require-fips` | bool | fail the cryptographic-module item unless the FIPS 140-3 module is in use |  |
| `--signer` | string | printed name of the package signer |  |
| `--signer-key` | string | sign the package with this Ed25519 key file instead of the machine's key |  |
| `--snapshot` | bool | treat the argument as a snapshot even if a sandbox has the same name |  |

## Example

```
  kosa8 validate iq stats-validated --out iq-2026-09.tar
  kosa8 validate iq stats-validated --baseline iq-2026-03.tar --baseline-key KEY
```

---
Source: https://docs.kosa8.com/reference/validate-iq/