autonomy ros2 keystore provision

Provision a multi-node secured graph from a manifest + distribute minimal per-node views

Synopsis

Provision a whole SROS 2 secured graph from one declarative manifest instead
of hand-scripting init + mint + permissions per node and hand-building the
per-node key views.

The manifest declares the governance domains, each enclave's least-privilege
topic surface (explicit publish/subscribe lists or a bundle via from_bundle),
and which node gets which minimal view. provision then inits the keystore
(idempotent), mints + grants each enclave (reusing 'keystore mint' +
'keystore permissions'), verifies the master, and writes a MINIMAL view per
node — public CA + governance + that ONE enclave's cert/key/permissions, and
deliberately NOT the CA private key or any other node's key. That view is the
isolation boundary: a shared keystore lets any node read every node's private
key; a per-node view hands each node only its own material.

Re-running is idempotent: an already-minted enclave is reused and its
permissions re-applied. Use --dry-run to print the plan without touching disk.

Manifest shape:

  keystore: /var/lib/autonomyops/ros2-keystore   # or pass --keystore
  domains: [42, 99]
  enclaves:
    - name: /governed_ros2_bridge_real
      domains: [42, 99]
      publish:   [/cmd_vel, "/cmd_vel/*"]
      subscribe: [/cmd_vel, "/cmd_vel/*"]
    - name: /perception
      domains: [99]
      from_bundle: demo/bundles/perception.tar
  views:
    - node: perception-container
      enclave: /perception
      out: dist/views/perception

Example:
  autonomy ros2 keystore provision --manifest graph.yaml
  autonomy ros2 keystore provision --manifest graph.yaml --dry-run

Usage

autonomy ros2 keystore provision --manifest graph.yaml [flags]

Options

      --dry-run              print the provisioning plan without minting, signing, or writing views
      --keystore keystore:   keystore root override (wins over the manifest's keystore: field)
      --manifest path        path to the YAML manifest describing the secured graph (enclaves, topic surface, per-node views)

Options inherited from parent commands

      --require-signed-manifest   Refuse to start if the SHA256SUMS release manifest or its cosign signature is missing/invalid (Tier 2 binary-integrity check; default: build-time compile-in via -ldflags -X, build-hardened artifacts=true, all others=false)

See also