kyvernon depot

The depot command of the kyvernon CLI with its subcommands and arguments.

`kyvernon depot`

Offline depot: verify, install, sign (no controller needed)

Usage

kyvernon depot <COMMAND>

Verify the signature and every file of a depot directory

Usage

kyvernon depot verify [OPTIONS] <DIR>

Argument	Description	Required
`<DIR>`	Depot directory	yes
`--pubkey`	Public key file in minisign format (default: KYVERNON_DEPOT_PUBKEY, then /etc/kyvernon/release-signing.minisign.pub, /usr/share/kyvernon/keys/..., then the key compiled into this binary) environment variable `KYVERNON_DEPOT_PUBKEY`

Verify a depot, then install its packages with dpkg (root)

Usage

kyvernon depot install [OPTIONS] <DIR>

Argument	Description	Required
`<DIR>`	Depot directory	yes
`--pubkey`	Public key file in minisign format (default: KYVERNON_DEPOT_PUBKEY, then /etc/kyvernon/release-signing.minisign.pub, /usr/share/kyvernon/keys/..., then the key compiled into this binary) environment variable `KYVERNON_DEPOT_PUBKEY`
`--role`	Which packages to install default `all`; values `controller`, `agent`, `cli`, `all`
`--dry-run`	Print the dpkg command instead of running it

Sign depot.json with the release key (offline signing machine only)

Usage

kyvernon depot sign [OPTIONS] <DIR>

Argument	Description	Required
`<DIR>`	Depot directory containing depot.json	yes
`--key`	Private key, OpenSSL PKCS#8 PEM (never stored in the repository) environment variable `KYVERNON_SIGNING_KEY`	yes
`--comment`	Trusted comment (covered by the signature); default names the version

Print the minisign public key and key id of a private key, or the key id of a public key

Usage

kyvernon depot pubkey [OPTIONS]

Argument	Description	Required
`--key`	Private key, OpenSSL PKCS#8 PEM environment variable `KYVERNON_SIGNING_KEY`
`--pubkey`	Public key file in minisign format
`--comment`	Untrusted comment written into the public key file default `kyvernon release signing key`

Version 0.1.