autonomy ros2 keystore verify

Report whether an SROS 2 keystore is complete (CA + governance + per-enclave cert/key/permissions)

Synopsis

Walk an SROS 2 keystore and report, per component, whether it is
complete: the CA (public/ca.cert.pem + private/ca.key.pem), governance
(enclaves/governance.xml + .p7s), and every enclave (cert.pem + key.pem +
permissions.xml + permissions.p7s).

The common trap this catches: an enclave minted with 'keystore mint' but whose
'keystore permissions' step never ran — the enclave dir + cert/key exist, so the
keystore LOOKS provisioned, but a node loading it fails closed under
Strategy=Enforce because there is no signed permissions.xml. verify reports that
enclave as INCOMPLETE (missing permissions.xml, permissions.p7s).

Exits non-zero if anything required is missing, so it fits a rebuild/CI gate.
Pure filesystem inspection — needs neither ros2 nor openssl.

Example:
  autonomy ros2 keystore verify --keystore /var/lib/autonomyops/ks

Usage

autonomy ros2 keystore verify [flags]

Options

      --keystore dir   dir path to the keystore root (created by 'autonomy ros2 keystore init')

Options inherited from parent commands

      --require-signed-manifest   Refuse to start if the SHA256SUMS release manifest or its cosign signature is missing/invalid (Tier 2 binary-integrity check; default: build-time compile-in via -ldflags -X, build-hardened artifacts=true, all others=false)

See also