oz0 index trust
Usage and flags for oz0 index trust.
For: Operators and developers looking up a command.
Pin a plugin index's root key: --root-key, or, for an index not trusted yet, the key its last fetched copy names when --fingerprint is that key's (compare it, from index list, with the one its publisher gives you). From then on the cluster takes a copy only when a key the root certified signed it. On a trusted index, only --root-key replaces the root.
--allow-withdrawn and --refuse-withdrawn set whether withdrawn and quarantined versions install with a warning or are refused (the default); on a trusted index they change nothing else. Cluster admins may.
Usage
oz0 index trust <name> [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--allow-withdrawn | bool | install withdrawn and quarantined versions with a warning | |
--fingerprint | string | the root key's fingerprint (SHA256:...) as its publisher gives it: pins the key the last fetched copy names only if it has this fingerprint | |
--json | bool | print JSON instead of a table | |
--refuse-withdrawn | bool | refuse new installs of withdrawn and quarantined versions (the default) | |
--root-key | string | the root key to pin (Ed25519, base64); it replaces a root already pinned |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.