oz0 index sign
For: Operators and developers looking up a command.
Sign an index payload (schemas/plugin-index/v1/index.schema.json) with the online key (--key) and attach its certificate (--cert). --version sets the payload's version, which must grow with every publication, and --expires sets its expiry from now (default 72h): the longest a withdrawal takes to reach every server. The published time is set to now, and each version's clashes are computed: the index's other plugins that cannot be installed in one tenant with it.
Each version without custody gets it: its publisher, repository and owner, and an epoch that goes up by one wherever they differ from the previous version's, so that servers ask a tenant's admin before an update takes code from new hands. A plugin that moved states moved_to, and its new listing moved_from: a move stated on one side only, one to another plugin name after the slash, one to a plugin the index does not list, and cycles are refused.
The payload is checked against the schema first. A version an agent made carries its provenance, which plugin inspect reads from the listed commit's OZ trailers: index sign keeps of it only the job and the agent as opaque text, the agent's plugin version, the model alias and the evidence counted by kind, and drops anything else. Each version's uses: is resolved to the index's listings (uses_resolved), and each plugin names the listings that use it (used_by).
The payload lists each version's full generated part, as plugin inspect --json prints it; index sign writes that part into --detail-dir as the version's detail document, a file named by its SHA-256, and signs a compact index that keeps what servers read and pins the document by its digest.
Servers never fetch the documents; publish the folder beside index.json for a site that shows plugin pages, and keep it: a version already compact is read back from it when the index is signed again.
Usage
oz0 index sign <index-payload.json> [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--cert | string | the online key's certificate, from index certify | |
--detail-dir | string | the folder each version's detail document is written to (and a compact version's read back from), named by its SHA-256; needed when the payload lists a version | |
--expires | string | 72h | how long from now the index is valid |
--key | string | the online key's file | |
--out (-o) | string | write index.json here instead of to standard output | |
--version | int | the payload's | the index's version |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.