`maqpna config bundle build`

Build and sign a configuration bundle from a directory

Operate-o json | yaml

Synopsis#

maqpna config bundle build DIR --key URI --out FILE [--revision N] [--issuer S] [--expires DUR] [--not-before T]

Flag	Type	Description	Default
`--expires`	duration	validity after creation, e.g. 168h (default: no expiry)	none
`--issuer`	string	issuer recorded in the manifest (default: $USER@maqpna-cli)	none
`--key`	string	signing key: a PKCS#8 PEM file, file:///…, kms://aws\|gcp\|azure\|vault\|openbao/…, azurekv://…, or pkcs11:… in -tags pkcs11 builds	none
`--not-before`	string	not valid before this time (RFC3339)	none
`--out`	string	bundle file to write (.tar.gz)	none
`--pq-key`	string	ML-DSA key (maqpna keys generate `--alg` ML-DSA-65): also sign with it (hybrid)	none
`--revision`	int	revision (default: the current Unix time); gateways apply only a revision above theirs	none

The global flags (--context, -o, --no-color, ...) work with every command.

$ maqpna config bundle build ./rendered --key file:///etc/maqpna/bundle.key --out edge.tar.gz --expires 168h

Prints a table by default; -o json or -o yaml print the data, and --jq EXPR filters the JSON.

Code	Meaning
`0`	success
`1`	error (the message says what failed, with a hint when there is one)
`2`	usage error: unknown flag, missing argument or bad value; the synopsis is printed
`3`	a check failed, a change is blocked, or a result did not match (tamper, policy mismatch) (not used by this command)