Named trust policies

A policy supplies verification roots for tine verify. Policies live in user configuration, never in a repository, so a clone cannot choose the keys you trust.

# Use independently trusted public-key and log-key files
tine trust policy set prod --pubkey ~/keys/release.pub --rekor-key ~/keys/rekor.pem --require-receipt
tine trust policy list --json
tine trust policy show prod --json
tine verify result.tine --attestation result.sigstore.json --policy prod --json

# Optional user default; bypass it for one invocation
tine trust policy default prod
tine verify result.tine --no-policy
tine trust policy default --clear

Supported roots are public key, pin, Rekor key, receipt requirement, certificate identity and OIDC issuer, and Fulcio root. Keyless identity fields apply to keyless evidence; receipt fields apply where relevant. --trust-embedded-key cannot be saved in a policy.

Precedence

--policy NAME selects a named policy. Explicit flags override its fields; any key flag replaces the policy key as a whole. The default applies only when no explicit policy, key, receipt, or keyless option is supplied. --no-policy disables it for one call. An unknown policy exits 1; JSON includes the policy name when one was used.

User-owned configuration

Policies are stored in $XDG_CONFIG_HOME/opentine/trust-policies.json with private permissions. Symlinked, group/world-writable, or foreign-owned policy files are refused. Key paths are absolute and rechecked on use. Repository trust.* and policy.* configuration cannot define or select roots.

Policies configure trust; they do not make unsigned evidence authentic. See in-toto and Sigstore verification for signature, identity, subject, and receipt checks.