evidence check command reference
Check a runtime file and the package it binds, offline, and report every problem found.
Contract status
Section titled “Contract status”This page is generated from the public Clap command tree for Registry Stack source version 0.46.0 and catalog SHA-256 d43b1bf418e0b00fac52311fa3a106fa124512dbc88cf511475713af2d73aa47. Hidden implementation commands are omitted.
Description
Section titled “Description”Check a runtime file and the package it binds, offline, and report every problem found. The check reads no secret material and contacts no network service. It reads the runtime file, verifies the package package.root names, loads and compiles the bundle, reads each CA bundle a trust profile names, and checks every binding between the runtime file and the bundle. It does not prove freezing, secret material, extract freshness, or runtime dependencies: startup proves them, and so does this command on the target host with —require-runtime-dependencies.
evidence check [OPTIONS] --runtime-config <FILE>Constraints
Section titled “Constraints”| Condition | Requirement |
|---|---|
--require-audit-under <ABSOLUTE_DIRECTORY> is present | --require-runtime-dependencies is required. |
--without-audit-lock is present | --require-runtime-dependencies is required. |
Options
Section titled “Options”| Option | Always required | Default | Values | Environment | Description |
|---|---|---|---|---|---|
--runtime-config <FILE> | Yes | n/a | n/a | n/a | Runtime configuration file |
--format <FORMAT> | No | human | human, json | n/a | Emit the selected command’s report in this format |
--deny-warnings | No | n/a | n/a | n/a | Exit 1 when a warning is reported |
--environment | No | n/a | n/a | n/a | Fill ${NAME} expressions in the runtime file from the process environment and check the values they produce. Without it, each expression is checked by syntax and position only |
--require-runtime-dependencies | No | n/a | n/a | n/a | Also prove, on the target host, what startup proves: read-only deployment inputs, secret material, extract freshness, audit writability, signer readiness, source credentials, and access-token JWKS reachability |
--require-audit-under <ABSOLUTE_DIRECTORY> | No | n/a | n/a | n/a | Also prove the configured audit sink resolves inside this absolute directory, which the deployment declares persistent. The declared root is a storage boundary, not a second audit setting. Evidence resolves its own configured destination exactly as startup resolves it and refuses when the result is not at or below the root, which is what stops a container from mounting durable storage at the conventional prefix while writing audit entries somewhere ephemeral. |
--without-audit-lock | No | n/a | n/a | n/a | Prove the audit destination without taking its single-writer lock, for a candidate staged beside the running instance that holds it. Modes, write access, and a complete final entry in the active file are still proved, and every other dependency is proved as without this flag. A second writer is not detected, so serve still refuses to start while one holds the lock. |
-h, --help | No | n/a | n/a | n/a | Print help (see a summary with ‘-h’) |
Generation contract
Section titled “Generation contract”After changing a public command, argument, option, default, environment binding, or help description, run cargo run --locked -p registry-cli-docs -- --write, commit crates/registry-cli-docs/catalog.json, then run npm run generate from docs/site.