Skip to content

`maqpna audit anchor`

Anchor a ledger checkpoint in a Sigstore Rekor transparency log

Observe-o json | yaml

Synopsis#

maqpna audit anchor FILE --key URI --rekor-url URL [--api v1|v2] [--rekor-key PEM|trusted_root.json] [--record]
maqpna audit anchor --gateway URL                  (the gateway anchors its ledger head now)

Flags#

Flag	Type	Description	Default
`--allow-gateway-mismatch`	switch	send the context's login token to a gateway other than the one it was issued for (env MAQPNA_ALLOW_GATEWAY_MISMATCH=1)	none
`--anchors-file`	string	anchor file (default FILE.anchors.jsonl)	none
`--api`	string	Rekor API: v1 \| v2 (v2: ES256 or RS256 keys only)	`v1`
`--gateway`	string	gateway base URL (env MAQPNA_GATEWAY_URL; default: the context's gateway)	none
`--key`	string	the audit-checkpoint signing key (file path, file:///…, pkcs11:… or kms://…; env MAQPNA_EVIDENCE_KEY)	none
`--oidc-token-file`	string	file holding an OIDC access token for the admin API (env MAQPNA_OIDC_TOKEN_FILE); wins over `--token`	none
`--record`	switch	also append an audit/anchored record to FILE (only while no gateway writes it)	none
`--rekor-key`	string	pinned log public key (PEM or Sigstore trusted_root.json; repeatable): the entry is verified before it is stored	none
`--rekor-url`	string	transparency log URL (e.g. https://rekor.sigstore.dev, or a private Rekor); publishing is opt-in	none
`--token`	string	static admin token (env MAQPNA_ADMIN_TOKEN; dev/break-glass)	none

The global flags (--context, -o, --no-color, ...) work with every command.

What happens when you run it#

Talks to the gateway: --gateway, else MAQPNA_GATEWAY_URL, else the current context's gateway (maqpna context).
Authenticates to the admin API with the token stored by maqpna login, --oidc-token-file, or a static --token (MAQPNA_ADMIN_TOKEN).
Prints a table by default; -o json or -o yaml print the data, and --jq EXPR filters the JSON.

Exit codes#

Code	Meaning
`0`	success
`1`	error (the message says what failed, with a hint when there is one)
`2`	usage error: unknown flag, missing argument or bad value; the synopsis is printed
`3`	a check failed, a change is blocked, or a result did not match (tamper, policy mismatch) (not used by this command)