fenced-pkg

Overview ¶

Command fenced-pkg is the CI-facing Agent Package tool (ADR-010): it generates package-signing keys, signs canonical manifests, and verifies signed packages against a trust registry. The control plane publishes a version only when its package verifies (fail-closed when the trust registry is configured).

Usage:

fenced-pkg genkey -id ci-builder-1              # prints keyId + base64 keys
fenced-pkg sign -manifest manifest.json \
    -key-id ci-builder-1 -private-key <b64> -out package.json
fenced-pkg verify -package package.json \
    -trust-key ci-builder-1=<b64pub> [-trust-key ...]
fenced-pkg validate-manifest -manifest agent-manifest.json \
    -out canonical-agent-manifest.json
fenced-pkg package-manifest -agent-manifest agent-manifest.json \
    -builder ci -workflow build.yml -git-commit abc -built-at <RFC3339> \
    -out package-manifest.json