Skip to content

pg_hardstorage_threshold.md

Latest commit

 

History

History
82 lines (64 loc) · 4.39 KB

pg_hardstorage_threshold.md

File metadata and controls

82 lines (64 loc) · 4.39 KB
Raw
title pg hardstorage threshold
description CLI reference for the pg hardstorage threshold command.
tags
cli
reference

pg_hardstorage threshold

k-of-n attestations: multi-party signing for highest-assurance manifests

Synopsis

Manage k-of-n attestations for highest-assurance manifests.

A roster names n trusted signers and a quorum threshold k. An attestation records that ≥ k roster members have vouched for some subject (a backup manifest, an audit anchor, a KEK rotation, etc.). Each member signs independently with their local operator key; signatures aggregate in the repo.

Operationally:

# 1. Each operator publishes their pub-key once
pg_hardstorage threshold whoami

# 2. An admin assembles the roster
pg_hardstorage threshold roster create prod-admins \
    --threshold 2 \
    --member alice@acme.example:<base64-pubkey> \
    --member bob@acme.example:<base64-pubkey> \
    --member charlie@acme.example:<base64-pubkey> \
    --description "Production cluster admins" \
    --repo s3://acme

# 3. To attest a backup, each member runs (any order):
pg_hardstorage threshold attest sign \
    backup_manifest db1.full.20260501T120000Z \
    --hash <sha256-hex> \
    --roster prod-admins \
    --repo s3://acme

# 4. Verify the quorum at any point:
pg_hardstorage threshold attest verify \
    backup_manifest db1.full.20260501T120000Z \
    --repo s3://acme

Options

  -h, --help   help for threshold

Options inherited from parent commands

      --airgapped airgapped: strict                                                       refuse outbound endpoints (LLM providers, sinks, OTLP collectors) outside loopback / RFC1918 / explicit airgap.allowlist. Also enabled by PG_HARDSTORAGE_AIRGAPPED=1 or airgapped: strict in the config file.
  -c, --config string                                                                     path to config file (default: XDG/FHS lookup)
      --cpu-profile go tool pprof <path>                                                  write a pprof CPU profile to this path for the duration of the command (go tool pprof <path> to analyse). Off when empty.
      --mem-profile string                                                                write a pprof heap profile to this path at command exit. Off when empty.
      --no-color                                                                          disable ANSI color in text output
      --on-error-llm                                                                      on a structured-error failure, drop into the matching LLM helper skill (auto_on_error trigger). Also enabled by PG_HARDSTORAGE_ON_ERROR_LLM=1.
      --otel-endpoint string                                                              OpenTelemetry OTLP/HTTP endpoint (e.g. http://otel-collector:4318); empty disables tracing
      --otel-stdout                                                                       also export OpenTelemetry traces to stderr (useful for dev)
  -o, --output string                                                                     output format: text|json|ndjson|yaml|template|csv|markdown|html|tap|junit|pdf (default: text on TTY, json off-TTY)
      --profile-port go tool pprof http://127.0.0.1:6060/debug/pprof/profile?seconds=30   if non-zero, expose net/http/pprof on 127.0.0.1:<port> for live profiling of long-running commands (e.g. go tool pprof http://127.0.0.1:6060/debug/pprof/profile?seconds=30). Off when zero.
  -q, --quiet                                                                             suppress non-essential output
      --template string                                                                   Go text/template applied when --output template (or implied if --template is set without --output)

SEE ALSO