CLI reference

Every documented untrust command and option, taken from the CLI's own --help. Options shown in square brackets, such as [nitro], apply only to that platform. Run untrust COMMAND --help for the same text locally.

Source

Generated from untrust 1.3.0 (commit 7ef462d9a0c3).

untrust scan

Run all audit checks against a target deployment.

Option	Value	Description
--platform	nitro | sev-snp | gpu-cc | azure-cvm	TEE platform to audit (default: nitro).
--target-bucket	TEXT	[nitro] S3 bucket holding the enclave's bootstrap state.
--kms-key-id	TEXT	[nitro] KMS key used to decrypt enclave secrets.
--instance-id	TEXT	[nitro] EC2 instance ID running the Nitro Enclave.
--region	TEXT	AWS region. (default us-west-2)
--pcr-baseline	PATH	[nitro] Path to a JSON of golden PCR values (PCR0/1/2) to pin (ENCLAVE-05).
--nitro-attestation-doc	PATH	[nitro] Path to a captured COSE_Sign1 attestation document (ENCLAVE-06).
--nitro-nonce	TEXT	[nitro] Hex verifier nonce the attestation document should echo (ENCLAVE-06).
--nitro-approved-signers	TEXT	[nitro] Approved EIF signing-certificate measurements (PCR8 SHA-384 hex, comma/space separated) for ENCLAVE-07.
--dynamodb-table	TEXT	[nitro] DynamoDB table holding enclave bootstrap state (alternative to S3).
--secret-arn	TEXT	[nitro] Secrets Manager secret ARN the enclave loads at boot.
--parameter-path	TEXT	[nitro] SSM Parameter Store name/prefix the enclave loads at boot.
--efs-id	TEXT	[nitro] EFS filesystem ID mounted for enclave state.
--db-instance	TEXT	[nitro] RDS/Aurora DB instance identifier holding enclave state.
--gcp-project	TEXT	[sev-snp] GCP project ID.
--wip-provider	TEXT	[sev-snp] WIF provider resource gating key release.
--gcp-kms-key	TEXT	[sev-snp] Cloud KMS key resource to audit IAM on.
--gcs-bucket	TEXT	[sev-snp] GCS bucket holding bootstrap state.
--gcp-instance	TEXT	[sev-snp] Confidential VM instance name.
--gcp-zone	TEXT	[sev-snp] Zone of the Confidential VM.
--attestation-token	PATH	[sev-snp] Path to a captured Confidential Space attestation token (JWT).
--gpu-attestation-report	PATH	[gpu-cc] Path to a captured NVIDIA GPU attestation report (JSON).
--gpu-verifier-policy	PATH	[gpu-cc] Verifier policy JSON: pinned RIM measurements, cert chain, revocation.
--gpu-cc-mode	TEXT	[gpu-cc] CC mode (nvidia-smi conf-compute -f): on|devtools|off.
--gpu-kbs-policy	PATH	[gpu-cc] Key-release policy JSON: attest-before-ready, decrypt location.
--gpu-model-bucket	TEXT	[gpu-cc] Object store holding model weights (injection probe).
--gpu-launch-config	PATH	[gpu-cc] Path to the CVM/GPU launch config (JSON) for the launch-mutability check.
--gpu-weight-file	PATH	[gpu-cc] Path to a model weight file; its leading bytes are sniffed to classify the real on-disk format (GPUCC-INPUT-01 bounded inspection).
--gpu-reset-evidence	PATH	[gpu-cc] Before/after-reset capture evidence (JSON) for GPUCC-PERSIST-01.
--gcp-secret	TEXT	[sev-snp] Secret Manager secret to audit attestation-gated access on.
--gcp-approved-signers	TEXT	[sev-snp] Approved workload-image signer key fingerprints (SHA-256 hex, comma/space separated) for CSPACE-SIGNER-01.
--expected-audience	TEXT	[sev-snp] Expected attestation-token audience (STS audience).
--expected-nonce	TEXT	[sev-snp] Verifier-issued eat_nonce the token must echo (CSPACE-ATT-03 replay check).
--expected-image-digest	TEXT	[sev-snp] Expected pinned workload image digest (sha256:...) the token/WIF must bind.
--gcp-org-id	TEXT	[sev-snp] Organization ID to audit org-policy constraints on.
--access-policy	TEXT	[sev-snp] Access Context Manager policy/perimeter for VPC-SC checks.
--azure-subscription	TEXT	[azure-cvm] Subscription ID.
--azure-resource-group	TEXT	[azure-cvm] Resource group of the VM.
--azure-vm	TEXT	[azure-cvm] Confidential VM name.
--azure-key-vault	TEXT	[azure-cvm] Key Vault (name or host) holding the SKR key.
--azure-key	TEXT	[azure-cvm] Key whose release policy gates the workload.
--azure-attestation-provider	TEXT	[azure-cvm] MAA provider name (in the resource group) or resource ID.
--azure-approved-attestation-authority	TEXT	[azure-cvm] MAA hosts you approve as release-policy authorities besides Microsoft's shared providers and --azure-attestation-provider (comma separated).
--azure-attestation-token	PATH	[azure-cvm] MAA token (JWT) captured inside the VM.
--output	PATH	Write JSON report to this path.
--json	flag	Print JSON output to stdout.
--read-only	flag	Passive scan only: exclude active object-write probes and host command execution on every supported platform; record excluded checks as SKIP.
--inventory, --no-inventory	flag	[nitro, sev-snp, azure-cvm] Also collect the cloud inventory the console's Inventory shows (instance, security groups, firewalls or NSG rules, role or service-account last use, who can reach the bucket, key or vault, and on AWS recent CloudTrail events) into the report's inventory section. Read-only; never affects findings.
--demo	flag	Run against a simulated vulnerable deployment (no cloud creds needed).

untrust list-checks

List all audit checks and their severity.

Option	Value	Description
--platform	nitro | sev-snp | gpu-cc | azure-cvm	TEE platform whose checks to list (default: nitro).

untrust diff

Show drift between two scan reports of the same target.

Exits 1 when any check newly fails (so CI can gate on regressions), 2 on bad input.

Arguments: OLD, NEW

Option	Value	Description
--json	flag	Print the drift as JSON.

untrust report-upload

Upload a scan report (JSON from untrust scan) to the hosted backend.

With --cs-attestation-token the service verifies the Confidential Space token against Google's signing keys and records only its verdict and a fingerprint (never the token), so a digest can be attested on the service's own verdict instead of the scanner's. Exits non-zero on 401/403 or an unreachable endpoint.

Arguments: DOCUMENT

Option	Value	Description
--org-url	TEXT	Your organization's API base, https://<host>/v1/organizations/<org>. (required)
--api-key	TEXT	Organization API key with a role that can write, or set UNTRUST_API_KEY. (required, env UNTRUST_API_KEY)
--cs-attestation-token	FILE	Confidential Space attestation token file (the one --attestation-token read in the workload). Sent beside the report so the service can verify it itself; never written into the report. Needs an expected audience set by an administrator (Settings), else the service reports it as not verified.

untrust buildscan

Check a completed build: exit 0=gate passed, 1=blocked, 2=incomplete/error.

Option	Value	Description
--artifact	PATH	Local EIF (nitro), VM boot bundle tar (vm-snp/vm-tdx), or uncompressed exported rootfs tar (other targets). (required)
--target	container | nitro | gcp | nvidia | vm-snp | vm-tdx	(required)
--commit	TEXT	Full source commit SHA supplied by the runner. (required)
--run-id	TEXT	CI build/run identity. (required)
--fail-on	critical | high | medium | low | info	(default high)
--timeout	INTEGER RANGE	(default 120)
--output	PATH	JSON report path. (required)
--sarif	PATH	Optional SARIF path.
--custom-rules	FILE	Local custom build/IaC rules file to evaluate, for testing draft rules before arming. Overrides UNTRUST_CUSTOM_RULES; same fail-closed loader as CI. A local scan's receipt is still re-checked against the org's armed set at ingest.
--image	TEXT	The image this run pushed, pinned by its registry manifest digest (e.g. the digest docker push or build-push-action reports). Lets Reproducible builds join this receipt to the registry artifact.
--progress-file	FILE	Append best-effort scan checkpoints (JSON lines) to this file; also read from UNTRUST_PROGRESS_FILE. The scanner never sends them: a separate CI step may. A write failure is ignored and never changes the verdict.

untrust iacscan

Gate a supplied IaC file — Terraform plan JSON, CloudFormation, ARM, GCP Deployment Manager, Azure Bicep, or a Kubernetes manifest (the format is auto-detected): exit 0=passed, 1=blocked, 2=incomplete/error.

Option	Value	Description
--plan	PATH	Existing terraform show -json plan output, at most 2 MB. (required)
--commit	TEXT	Full source revision supplied by CI. (required)
--run-id	TEXT	CI run identity. (required)
--fail-on	critical | high | medium | low | info	(default high)
--output	PATH	(required)
--source-dir	DIRECTORY	Terraform configuration directory the plan was made from: adds a best-effort file:line to each finding (text search only; nothing outside the directory is read and nothing is executed).
--custom-rules	FILE	Local custom IaC rules file to evaluate, for testing draft rules before arming. Overrides UNTRUST_CUSTOM_RULES; same fail-closed loader as CI. A local scan's receipt is still re-checked against the org's armed set at ingest.
--progress-file	FILE	Append best-effort scan checkpoints (JSON lines) to this file; also read from UNTRUST_PROGRESS_FILE. The scanner never sends them: a separate CI step may. A write failure is ignored and never changes the verdict.

untrust ci-feedback

Post a gate result to the pull request: GitHub Check Run + annotations, code-scanning SARIF, or a GitLab MR note + commit status. Tokens come from GITHUB_TOKEN / UNTRUST_GITLAB_TOKEN in the job environment only.

Option	Value	Description
--kind	build | iac	(required)
--report	FILE	The gate's JSON report (buildscan --output / iacscan --output). (required)
--mode	absolute | regression	absolute: the scanner's own gate. regression: fail only on blocking findings new or worse than --base-report. ERROR and armed custom-rule blocks are never relaxed; an unusable base falls back to absolute. (default absolute)
--base-report	FILE	The base branch's last report of the same kind.
--scanner-exit	INTEGER RANGE	The scanner's exit code, cross-checked against its report.
--provider	auto | github | gitlab | none	(default auto)
--head-sha	TEXT	Commit the check/status attaches to (a PR's head, not the merge commit).
--code-scanning	flag	GitHub: also upload SARIF to code scanning (needs security-events: write).
--sarif	FILE	Build SARIF to upload with --code-scanning (IaC is generated).
--summary-file	PATH	Append the markdown summary here, e.g. $GITHUB_STEP_SUMMARY.
--strip-prefix	TEXT	Build: the in-artifact install dir to strip from finding paths. (env UNTRUST_SOURCE_PATH_PREFIX)
--repo-prefix	TEXT	Build: the repository source dir to prepend after stripping. (env UNTRUST_SOURCE_REPO_PREFIX)
--repo-relative	flag	Build: the scanned artifact already uses repository-relative paths.
--fetch-base	flag	GitLab regression mode: fetch the target branch's last report of this job (same path) with CI_JOB_TOKEN. Failure means the full gate applies.
--rule-settings	FILE	The org's rule levels: the JSON GET /rule-overrides returns. Applies per-rule severity, enforcement (block/warn/report) and the profile, so the PR check agrees with ingest. Never looser for a floor rule or an incomplete analysis. (env UNTRUST_RULE_SETTINGS)
--dry-run	flag	Print the provider requests; send nothing.
--exit-with-verdict	flag	Exit 0/1/2 for PASS/FAIL/ERROR. Use when this step is the job's gate.

untrust registry

Image registry: resolve artifacts by digest, verify signatures and EIF measurements.

Subcommands: bind, detect, pins, scan

untrust registry scan

Resolve each artifact to its digest and verify it against the trust policy.

Exit code: 0 every artifact verified, 1 any confirmed failure (unsigned, untrusted signature, moved tag, measurement mismatch), 2 anything that could not be assessed (no access, cosign missing, no trust root). Signature verification for OCI images uses the cosign binary (UNTRUST_COSIGN or PATH).

Option	Value	Description
--policy	FILE	Trust policy JSON naming the artifacts and trust roots.
--policy-url	TEXT	Fetch the workspace's registry policy (Registry > Trust policy) with the CI binding's identity: https://<origin>/v1/ci-policy/<org>/<binding>.
--github-oidc	flag	[--policy-url] Request the ID token from GitHub Actions OIDC (otherwise UNTRUST_CI_ID_TOKEN).
--image	TEXT	Artifact to inspect without a policy file (repeatable): an OCI reference or s3://bucket/key.eif. (repeatable)
--key	TEXT	[--image] cosign public key path or KMS URI to trust (repeatable). (repeatable)
--certificate-oidc-issuer	TEXT	[--image] keyless: expected OIDC issuer.
--certificate-identity	TEXT	[--image] keyless: exact signer identity.
--certificate-identity-regexp	TEXT	[--image] keyless: anchored identity regexp.
--eif-pcr8	TEXT	[--image] trusted EIF signing certificate, as its PCR8 (repeatable). (repeatable)
--output	PATH	Write the registry report (JSON) to this path.
--json	flag	Print the report to stdout.
--deadline	INTEGER RANGE	Seconds for the whole scan; artifacts not reached are reported unassessed. (default 900)
--jobs	INTEGER RANGE	Artifacts inspected in parallel. (default 4)

untrust registry bind

REG-BIND-01: do the measurements a deployment trusts and runs belong to verified artifacts?

Exit code: 0 every deployment bound, 1 any measurement unverified, stale or unknown, 2 no deployment recorded a measurement to check.

Option	Value	Description
--registry	FILE	An untrust registry scan report. (required)
--runtime	FILE	An untrust scan report (Nitro or Confidential Space); repeatable. (required, repeatable)
--json	flag	Print the REG-BIND-01 findings as JSON.

untrust registry pins

Key-release pins that admit only artifacts this scan verified (and are in date).

Option	Value	Description
--registry	FILE	An untrust registry scan report. (required)
--format	kms | wif	kms: Nitro KMS key policy Condition block (PCR0). wif: Confidential Space WIF condition clause (image_digest). (required)

untrust registry detect

Registry change detections (DET-R1..R4) for the repositories a policy watches.

ECR from CloudTrail (tag moved, unsigned push, immutability off, repository opened); Artifact Registry and gcr.io from Admin Activity audit logs (immutability off, repository opened; push rules are reported as not covered). Read-only.

Option	Value	Description
--policy	FILE	Registry trust policy: the repositories, tags and released digests to watch. (required)
--since	INTEGER RANGE	Minutes of audit log to read (default 60).
--grace	INTEGER RANGE	Minutes a push may wait for its signature before DET-R2 calls it unsigned. (default 10)
--output	PATH	Write {"events": [...]}, the CI "detections" evidence document.
--json	flag	Print the events as JSON.

untrust detect

Read cloud audit logs (and the enclave host) for runtime detections on one deployment.

TEE rules watch the attestation boundary: key release without or outside attestation, the policy and grants that gate release, and what the TEE runs. Cloud rules watch the resources around it.

Option	Value	Description
--platform	nitro | sev-snp | azure-cvm | gpu-cc | kbs	nitro: AWS Nitro Enclaves (CloudTrail). sev-snp: GCP Confidential Space (Cloud Audit Logs). azure-cvm: Azure confidential VMs (Activity Log + Key Vault AuditEvent). gpu-cc: NVIDIA GPU CC (successive evidence captures). kbs: key-broker release events (kbs:release). (default nitro)
--target-bucket	TEXT	[nitro] S3 bucket holding the enclave's bootstrap state.
--kms-key-id	TEXT	[nitro] KMS key the enclave decrypts its state with.
--instance-id	TEXT	[nitro] EC2 instance running the enclave.
--region	TEXT	[nitro] AWS region. (default us-west-2)
--gcp-project	TEXT	[sev-snp] GCP project ID.
--wip-provider	TEXT	[sev-snp] Workload Identity provider gating key release.
--gcp-kms-key	TEXT	[sev-snp] Cloud KMS key the workload decrypts with.
--gcp-instance	TEXT	[sev-snp] Confidential Space VM name.
--gcp-zone	TEXT	[sev-snp] Zone of the Confidential Space VM.
--gcp-service-account	TEXT	[sev-snp] Workload service account email the pool impersonates (DET-C10).
--gcs-bucket	TEXT	Accepted for parity with scan; unused.
--azure-subscription	TEXT	[azure-cvm] Azure subscription ID.
--azure-vault	TEXT	[azure-cvm] Key Vault name holding the gated key.
--azure-key	TEXT	[azure-cvm] Key name whose release policy gates the VM.
--azure-vm	TEXT	[azure-cvm] Confidential VM name.
--azure-identity	TEXT	[azure-cvm] The VM's managed-identity object id.
--azure-attestation-provider	TEXT	[azure-cvm] MAA provider name.
--azure-disk	TEXT	[azure-cvm] The VM's OS disk name.
--azure-log-file	PATH	[azure-cvm] Read Activity Log / AuditEvent entries from this JSON file (array) instead of the live Azure Monitor API.
--kbs-log-file	PATH	[kbs] Read kbs:release events from this JSON file (array, or {"events": [...]}); fixture-only until a live broker forwarder is enrolled.
--capture	DIRECTORY	[gpu-cc] A capture directory holding report.json and its nvattest outputs; repeat for each capture of the deployment, in any order. (repeatable)
--max-gap-hours	FLOAT RANGE	[gpu-cc] Longest allowed gap between captures (DET-G7). (default 24.0)
--since	INTEGER RANGE	Look back this many minutes (cloud platforms; gpu-cc reads the captures given). (default 60)
--expected-pcr0	TEXT	[nitro] Released enclave image measurement (PCR0, hex); repeat for several builds. Enables DET-07 and DET-11. (repeatable)
--host-check	flag	[nitro] Also run nitro-cli on the host through SSM (DET-06, DET-11).
--output	PATH	Write {"events": [...]}, the CI "detections" evidence document.
--coverage-output	PATH	[nitro] Write {"window", "rules": [{rule_id, evaluated, matched, ok}]}, the CI "detection-coverage" evidence document, so the Detect OK/Info view shows real evaluated counts.
--json	flag	Print the events as JSON.

untrust collector

Hardware fleet collector: enroll once, then report on a schedule (outbound only).

Subcommands: enroll, install-service, nitro-agent, run, scan

untrust collector enroll

Register this host's collector key with a fleet.

Option	Value	Description
--origin	TEXT	untrust origin, e.g. https://app.untrustsecurity.com (required)
--token	TEXT	One-time enrollment token from Environments, Hardware fleets. (required, env UNTRUST_ENROLL)
--state-dir	DIRECTORY	Where the collector keeps its key (default: ~/.untrust-collector).
--ca-file	FILE	CA bundle for a private untrust origin (default: system trust store).

untrust collector run

Send signed host reports (attestation and the local host scan) to the fleet.

Option	Value	Description
--once	flag	Send one report and exit.
--no-scan	flag	Attestation only: do not run the local host checks (collector scan).
--manifest	FILE	Boot-inputs manifest for the local scan (adds BOOT-IN-01/02).
--interval	INTEGER RANGE	Seconds between reports. (default 900)
--collect-root-logins	flag	Report successful root sshd logins (time, method, source IP, key fingerprint; root only, no command content) for runtime root-login detection (DET-H11).
--state-dir	DIRECTORY	Where the collector keeps its key (default: ~/.untrust-collector).
--ca-file	FILE	CA bundle for a private untrust origin (default: system trust store).

untrust collector install-service

Keep the collector reporting: install and start a systemd service (root).

Option	Value	Description
--interval	INTEGER RANGE	Seconds between reports. (default 900)
--no-scan	flag	Install the service in attestation-only mode (no local host checks).
--manifest	FILE	Boot-inputs manifest the service's local scan reads each interval.
--collect-root-logins	flag	Report successful root sshd logins for runtime root-login detection (DET-H11).
--state-dir	DIRECTORY	Where the collector keeps its key (default: ~/.untrust-collector).
--ca-file	FILE	CA bundle for a private untrust origin (default: system trust store).

untrust collector scan

Run the host checks once on this machine (collector mode, read-only, no enrollment).

Option	Value	Description
--output	FILE	Also write the JSON report here.
--manifest	FILE	Boot-inputs manifest (untrust.boot-inputs/v1): adds BOOT-IN-01/02.

untrust collector nitro-agent

Inside a Nitro enclave: answer the parent collector's attestation requests.

Option	Value	Description
--port	INTEGER	vsock port to answer attestation requests on. (default 5005)

untrust api

Read your organization's untrust API with an org API key (CI and SIEM pulls).

Subcommands: get

untrust api get

GET one resource, e.g. https://<host>/v1/organizations/<org>/issues, and print it.

The key's role decides what it can read. Exits non-zero on 401 (invalid, expired or revoked key) and 403 (role too narrow).

Arguments: URL

Option	Value	Description
--api-key	TEXT	Organization API key (Settings › API keys), or set UNTRUST_API_KEY. (required, env UNTRUST_API_KEY)

untrust ci

Hosted CI-ingest evidence: verify a stored submission envelope's signed receipt.

Subcommands: verify

untrust ci verify

Verify a stored CI-ingest submission envelope's signed receipt — trusting only the key you pin and the organization you expect, not the database or the service.

ENVELOPE is one stored ci-evidence envelope, as the service returns a single item. The signature is checked over the whole envelope first; then the envelope's own organization (inside the signed content) must be --org. Exits 0 only when both hold; 1 when it does not verify or belongs to another organization; 2 when --public-key or --org is missing; 3 when it is unsigned or names no organization.

Arguments: ENVELOPE

Option	Value	Description
--public-key	PATH	Required: PEM public key of the trusted signer (your KMS key). The receipt is accepted only when it verifies against this exact key.
--org	TEXT	Required: the organization id the envelope must belong to. One key signs every organization's receipts, so another organization's envelope fails.

Exit codes:
  0  VERIFIED: integrity, the trusted key and the organization all hold
  1  NOT VERIFIED: tampered, another key or another organization
  2  usage: a required binding input (key or organization) is missing
  3  UNSIGNED or UNBOUND (legacy): nothing proves who signed it or for which organization

untrust pack

Evidence packs: signed, verifiable policy+window bundles.

Subcommands: verify

untrust pack verify

Verify an evidence pack's integrity, its organization, and its signature when a trusted key is given.

Arguments: FILE_PATH

Option	Value	Description
--public-key	PATH	Trusted public key (PEM) to check the pack's signature against (Ed25519 or ECDSA P-256).
--organization	TEXT	Required: the organization id the pack must have been generated for; any other fails. A pack naming no organization (legacy) always fails.

Exit codes:
  0  VERIFIED: integrity, the trusted key and the organization all hold
  1  NOT VERIFIED: tampered, another key or another organization
  2  usage: a required binding input (key or organization) is missing
  3  UNSIGNED or UNBOUND (legacy): nothing proves who signed it or for which organization

untrust ledger

Trust decisions ledger: key releases, observed or decided.

Subcommands: collect, verify

untrust ledger verify

Verify one ledger entry against the evidence it cites.

Arguments: ENTRY_ID

Option	Value	Description
--file	PATH	A decision from the API (/decisions/<id>), or a ledger upload batch. (required)
--public-key	PATH	PEM public key of the trusted signer: honour a decided entry's signed receipt only when it verifies against this key.
--org	TEXT	The organization id the decision must belong to. A decided entry bound to another organization fails, and a legacy entry that names none is not verified for it.

Exit codes:
  0  VERIFIED: integrity, the trusted key and the organization all hold
  1  NOT VERIFIED: tampered, another key or another organization
  2  usage: a required binding input (key or organization) is missing
  3  UNSIGNED or UNBOUND (legacy): nothing proves who signed it or for which organization

untrust ledger collect

Read cloud KMS/SKR key releases (read-only) into a ledger upload batch.

These entries are OBSERVED: untrust did not gate the releases. Upload the batch as CI evidence of kind "ledger"; the service rebuilds every entry from the raw records, so the provider and verdict cannot be spoofed by the uploader.

aws reads CloudTrail live for the given keys. gcp|azure read a cloud-log export from --log-file (GCP Cloud Logging audit entries / Azure Key Vault AuditEvents).

Option	Value	Description
--platform	aws | gcp | azure	Cloud whose key-release logs to read. (default aws)
--region	TEXT	[aws] AWS region of the KMS key.
--kms-key-id	TEXT	Key: ARN/ID (aws) or resource/name to filter (gcp|azure); repeatable. (repeatable)
--since	INTEGER RANGE	[aws] Minutes of CloudTrail history to read (default 60).
--log-file	PATH	[gcp|azure] Read cloud-log entries (JSON list, or {entries|value: [...]}) from this file. Live collection is not wired yet; export the window first.
--output	PATH	Write the ledger upload batch ({"records": [...], "provider": ...}) here. (required)

untrust release

Relying-party key-release gate: ask untrust to verify evidence and record a DECIDED ledger entry before a workload uses a key.

Subcommands: se-request, verify

untrust release verify

Ask untrust to gate one key release and print the recorded decision.

The receipt is 'unsigned' until an operator provisions the KMS signer; integrity is the ledger's hash chain meanwhile. Exits non-zero when the release is denied.

Option	Value	Description
--endpoint	TEXT	https://<host>/v1/organizations/<org>/release-verifications (required)
--token	TEXT	Organization API key (Settings › API keys; analyst or administrator role), or set UNTRUST_API_KEY. (required, env ['UNTRUST_API_KEY', 'UNTRUST_API_TOKEN'])
--fleet-id	TEXT	Fleet the host belongs to. (required)
--key	TEXT	Identifier of the key whose release is gated. (required)
--requester	TEXT	Who is asking (e.g. the KBS identity). (required)
--workload	TEXT	Workload the key would be released to. (required)
--nonce	TEXT	base64url 32-byte challenge the evidence is bound to. (required)
--public-key	TEXT	base64url wrap public key the evidence is bound to. (required)
--evidence	PATH	JSON evidence file, e.g. {"tdx": {...}} or {"sev-snp": {...}}.
--se-response	PATH	IBM SE: the pvattest response file, instead of --evidence (see untrust release se-request).
--request-id	TEXT	Idempotency key (1-100 of [A-Za-z0-9_-]); generated when omitted.

untrust release se-request

Get an IBM SE attestation request for one key release.

An SE guest cannot produce a standalone quote: it answers a request only untrust and the fleet's verified IBM Z hosts can read. Run, in the guest:

pvattest perform --input request.bin --user-data user-data.bin --output response.bin

then untrust release verify ... --se-response response.bin with the same nonce and public key. The request is spent by that one verification and expires in 10 minutes.

Option	Value	Description
--endpoint	TEXT	https://<host>/v1/organizations/<org>/release-verifications (the SE request endpoint next to it is used). (required)
--token	TEXT	Organization API key (analyst or administrator role), or set UNTRUST_API_KEY. (required, env ['UNTRUST_API_KEY', 'UNTRUST_API_TOKEN'])
--fleet-id	TEXT	The IBM SE fleet. (required)
--nonce	TEXT	base64url 32-byte challenge; pass the same one to release verify. (required)
--public-key	TEXT	base64url wrap public key; pass the same one to release verify. (required)
--out-dir	DIRECTORY	Where to write request.bin and user-data.bin for pvattest. (required)

untrust measure

Compute expected TEE launch measurements from build artifacts.

Subcommands: gce-endorsement, ibm-se-tags, launch, snp, tdx, tdx-eventlog, tpm-eventlog

untrust measure snp

Compute the expected AMD SEV-SNP launch MEASUREMENT for a guest.

Option	Value	Description
--ovmf	FILE	OVMF firmware image the guest boots (an SEV/AmdSev build). (required)
--vcpus	INTEGER RANGE	Guest vCPU count. (required)
--vmm	qemu | ec2 | gce	VMM that launches the guest. (default qemu)
--vcpu-type	TEXT	QEMU -cpu model (e.g. EPYC-Milan); required for qemu.
--vcpu-sig		Raw CPUID signature instead of a model.
--kernel	FILE	Kernel for measured direct boot (-kernel).
--initrd	FILE	Initrd (-initrd).
--append	TEXT	Kernel command line (-append).
--guest-features		VMSA SEV_FEATURES (bit 0 = SNPActive). (default 0x1)
--ovmf-hash	TEXT	Precomputed OVMF digest (96 hex) to use instead of the file's pages.
--baseline-out	FILE	Add the measurement to this --host-baseline file (created if absent).
--json	flag	Print the full record as JSON.

untrust measure tdx

Compute the expected Intel TDX MRTD for a TDVF firmware image.

MRTD covers the firmware only; the kernel, initrd and command line of a direct boot are measured into RTMR[1]/RTMR[2], which this does not predict.

Option	Value	Description
--firmware	FILE	TDVF/OVMF image the TD boots (the single combined image QEMU loads with -bios). (required)
--baseline-out	FILE	Add the MRTD to this baseline file under tdx.mrtd (created if absent).
--json	flag	Print the full record as JSON.

untrust measure launch

Compute the expected measurement from a launch-inputs manifest (untrust.launch-inputs/v1).

The same manifest and code path as LAUNCH-01 (collector scan --bundle --launch), so the value printed here is exactly what LAUNCH-01 compares. Pin it in the fleet policy's expected measurements, and the fleet verifier checks it (SNP-MEAS-01 / TDX-MEAS-01) on every signature-verified report.

Arguments: MANIFEST

Option	Value	Description
--baseline-out	FILE	Add the measurement to this --host-baseline file (created if absent).
--json	flag	Print the full record as JSON.

untrust measure tdx-eventlog

Verify a TDX event log: replay to the quoted RTMRs, find the build's boot events.

RTMR[0] includes VMM-generated events, so RTMRs are checked by replaying the log rather than predicted. Exit 0 only if every requested check matches.

Option	Value	Description
--ccel	FILE	The TD's event log (/sys/firmware/acpi/tables/data/CCEL). (required)
--rtmrs	TEXT	RTMRs from the verified quote, comma-separated hex: RTMR[0..2], or RTMR[0..3] (RTMR[3] is runtime-extended, not in the log).
--kernel	FILE	Kernel the TD booted; its Authenticode hash must be in RTMR[1].
--initrd	FILE	Initrd; its SHA-384 must be the Linux initrd event in RTMR[2].
--append	TEXT	Kernel command line; must be measured in RTMR[2].
--json	flag	Print the full result as JSON.
--output	FILE	Write an untrust.boot-replay/v1 document (CI evidence kind 'replay').
--label	TEXT	[--output] Which machine or image this replay is for.
--observed	TEXT	[--output] When the log and registers were captured (ISO 8601 with a UTC offset). Defaults to now; set it when replaying an earlier capture so the document is not presented as fresh evidence.

untrust measure tpm-eventlog

Verify a TPM measured boot: replay the log to the quoted PCRs, find the build's events.

Exit 0 only if every requested check matches.

Option	Value	Description
--log	FILE	The firmware's TCG event log (/sys/kernel/security/tpm0/binary_bios_measurements). (required)
--pcrs	FILE	Quoted PCR values as JSON: {"sha256": {"0": "<hex>", ...}}.
--bank	sha256 | sha384 | sha1	PCR bank to replay and check. (default sha256)
--kernel	FILE	Kernel; its Authenticode hash must be in PCR4.
--initrd	FILE	Initrd; must be measured in PCR9 (Linux stub or grub).
--append	TEXT	Kernel command line; must be measured in PCR8/9/12.
--json	flag	Print the full result as JSON.
--output	FILE	Write an untrust.boot-replay/v1 document (CI evidence kind 'replay').
--label	TEXT	[--output] Which machine or image this replay is for.
--observed	TEXT	[--output] When the log and registers were captured (ISO 8601 with a UTC offset). Defaults to now; set it when replaying an earlier capture so the document is not presented as fresh evidence.

untrust measure gce-endorsement

Verify a Google-signed GCE launch endorsement and use its expected measurements.

Exit 0 only if the signature chains to a pinned GCE TCB root and, with --firmware, the firmware and every recomputed value match the endorsement.

Option	Value	Description
--endorsement	FILE	A GCE launch endorsement (.binarypb from gs://gce_tcb_integrity). (required)
--firmware	FILE	The firmware it names; its SHA-384 and recomputed values are checked.
--vcpus	INTEGER RANGE	SEV-SNP: the vCPU count whose endorsed measurement to pin.
--baseline-out	FILE	Pin the endorsed value: sev-snp.measurements (needs --vcpus) or tdx.mrtd.
--json	flag	Print the full result as JSON.

untrust measure ibm-se-tags

Print an IBM SE image's boot header tags (416 hex) to pin in an ibm-se fleet.

IMAGE is the SE boot image or its header (pvextract-hdr). The tags are what the Ultravisor's attestation measurement covers; the last 32 hex digits are the SE header tag.

Arguments: IMAGE