Certificate commands

Inspect

fa certificate inspect migration-certificate.json

Inspection validates the envelope schema and reports certificate, organization, estate, object, wave, profile, issuer, key ID, and computed unsigned-envelope digest. It shows whether the digest matches the signed digest but does not claim signature validity.

Verify

Create a JSON file that maps key IDs to Ed25519 public PEM values:

{
  "airlift-migration-cert-v1": "-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----\n"
}

Then verify:

fa certificate verify migration-certificate.json --keys public-keys.json

Without --keys, verification reads AIRLIFT_EVIDENCE_VERIFY_KEYS_JSON. The command recomputes canonical content, requires the signed digest to match, selects the declared key ID, and verifies the Ed25519 signature. Malformed input, tampering, unknown keys, and invalid signatures return non-zero.