`maqpna config bundle verify`

Check a configuration bundle's signature, files, issuer, validity and revision

Operate-o json | yaml

Synopsis#

maqpna config bundle verify FILE (--pubkey PEM | --jwks FILE|URL | --allow-unpinned) [--issuer S] [--current-revision N]

Flag	Type	Description	Default
`--allow-unpinned`	switch	check against the key embedded in the bundle (integrity, not authenticity)	none
`--current-revision`	int	the revision in force: the bundle's must be above it	none
`--issuer`	string	comma-separated trusted issuers (default: any)	none
`--jwks`	string	JWKS file or URL with the trusted keys	none
`--pubkey`	string	PEM file with the trusted public key(s) (required unless `--allow-unpinned`)	none
`--signature-policy`	string	classical (one trusted signature), hybrid (classical and ML-DSA) or pq (ML-DSA)	`classical`

The global flags (--context, -o, --no-color, ...) work with every command.

$ maqpna config bundle verify edge.tar.gz --pubkey bundle.pub --current-revision 41

Prints a table by default; -o json or -o yaml print the data, and --jq EXPR filters the JSON.

Code	Meaning
`0`	success
`1`	error (the message says what failed, with a hint when there is one)
`2`	usage error: unknown flag, missing argument or bad value; the synopsis is printed
`3`	a check failed, a change is blocked, or a result did not match (tamper, policy mismatch) (not used by this command)