plimsoll-attest

plimsoll-attest keygen -out prefixplimsoll-attest run -daemon url [-key file] -bundle file [-shared-bundle] [-timeout duration] request.jsonplimsoll-attest verify -pub file [-expect file | -expect-count n] bundleplimsoll-attest replay -daemon url -pub file bundle

plimsoll-attest is a harness that runs outside plimsolld. It makes a signing key, submits a run, signs the checked record into a JSONL bundle, verifies that bundle (signatures, digests, link chain, session chains, and optionally the caller's own request list), and replays recorded runs against a daemon to compare results. The signing key never goes to the daemon.The request file is a `plimsoll.v1.RunRequest` in protobuf JSON, for example `{"protocol": 2, "javascript": {"code": "console.log(1)"}}`. The daemon bearer is PLIMSOLL_CALLER_TOKEN. The signing key is -key or PLIMSOLL_ATTEST_KEY (the PEM itself) so neither appears in a process listing.run takes a lock on the bundle so concurrent runs take turns (no lock on Windows, Solaris, illumos, or AIX: run one at a time there). Default timeout is 6 minutes. A new bundle is created mode 0600. A bundle other users can read is refused unless -shared-bundle. If the append fails after the run, a signed unsealed side file is kept beside the bundle rather than dropping the record. keygen uses O_EXCL and will not overwrite an existing `.key`.Build from `cmd/plimsoll-attest` in the Plimsoll module (`go install github.com/plimsollmark/plimsoll/cmd/plimsoll-attest@latest`).

keygen -out prefix

Write prefix`.key` (mode 0600) and prefix`.pub`. Fails if the key file already exists

Run one request, sign the exchange, append it to the bundle under a lock, and print the sandbox, isolation, record SHA-256, and request SHA-256 (the line for verify -expect)

Check signatures, digests, the bundle chain, and session chains. -expect requires the bundle to hold exactly the request digests listed, one `request_sha256` per line. -expect-count checks the number of calls

Verify as verify does, then send each single run again and each recorded session's calls, in order, into a fresh session, and compare results

PLIMSOLL_CALLER_TOKEN

Bearer token for the daemon. Omit for an open development daemon

Signing key PEM when -key is not given

A bundle signed by another key, or written before bundle links, cannot be continued: start a new one. A crash that leaves a partial last line can be repaired by cutting back to the last checkpoint. Bundles hold the submitted code and its output; keep them owner-only. Unknown subcommands and missing arguments exit 2. A run that errors has no record and leaves the bundle unchanged.

Part of Plimsoll (`plimsollmark/plimsoll`), Apache-2.0. The binary lives at `cmd/plimsoll-attest`.

plimsolld(1), plimsoll-clients(1), go(1)

Source code · Documentation