---
title: "oz0 index trust"
description: "Usage and flags for oz0 index trust."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/index/trust"
---
# oz0 index trust

> Usage and flags for oz0 index trust.

For: Operators and developers looking up a command.

Pin a plugin index's root key: --root-key, or, for an index not trusted yet, the key its last fetched copy names when --fingerprint is that key's (compare it, from `index list`, with the one its publisher gives you). From then on the cluster takes a copy only when a key the root certified signed it. On a trusted index, only --root-key replaces the root.

--allow-withdrawn and --refuse-withdrawn set whether withdrawn and quarantined versions install with a warning or are refused (the default); on a trusted index they change nothing else. Cluster admins may.

## Usage

```bash
oz0 index trust <name> [flags]
```

## Flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --allow-withdrawn
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      install withdrawn and quarantined versions with a warning
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --fingerprint
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the root key's fingerprint (SHA256:...) as its publisher gives it: pins the key the last fetched copy names only if it has this fingerprint
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --json
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      print JSON instead of a table
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --refuse-withdrawn
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      refuse new installs of withdrawn and quarantined versions (the default)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --root-key
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the root key to pin (Ed25519, base64); it replaces a root already pinned
    </td>
  </tr>
</tbody>
</table>

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.