oz0 evidence export
For: Operators and developers looking up a command.
Write a tenant's evidence bundle to --out: a new or empty folder, or a file ending in .zip. --from and --to bound the period (RFC 3339; open ends without them). The two-way check covers the jobs that started and ended inside the period (and after the oldest gateway record retention kept); a job running across --from is checked by no export with that start, so leave out --from to check every job of the chain.
The tenant's admins may export; without the content permission, or when the tenant's walls apply to the exporter, each audit entry's private part is left out and its hash kept, the digests of what jobs read and wrote are keyed for this one bundle, so they cannot confirm a guess of what they cover, and salts are left out, which would confirm one too.
evidence verify still runs to its end on such a bundle: equal digests stay equal in it, and what its hashes can no longer show rests on the audit key's signature. Every export is in the audit chain (evidence.export).
Usage
oz0 evidence export [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--from | string | the period's start (RFC 3339) | |
--out | string | a new or empty folder, or a file ending in .zip | |
--tenant | string | the default tenant | the tenant |
--to | string | the period's end (RFC 3339) |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.