CLI reference¶
| Command | Description |
|---|---|
constle run [--backend=docker\|firecracker] <agentfile> |
Run an agent in an isolated sandbox |
constle validate <agentfile> |
Validate an Agentfile without running it |
constle init |
Scaffold a starter Agentfile in the current directory |
constle ps |
List running and recent Constle-managed agents |
constle stop <run-id> |
Stop a running agent by run ID |
constle identity create <name> [--owner=<email>] |
Generate an agent DID (Ed25519 key pair) |
constle identity show <name> |
Show an agent's DID and key location |
constle audit verify [--did=<did:key:…>] <logfile> |
Verify an audit log's signatures and hash chain |
constle version |
Print the version |
Verifying a release¶
Every release ships a checksums.txt covering all archives, signed with cosign keyless signing from the release workflow. Download checksums.txt, checksums.txt.sig, and checksums.txt.pem next to your archive, then:
cosign verify-blob \
--certificate checksums.txt.pem \
--signature checksums.txt.sig \
--certificate-identity-regexp '^https://github\.com/constle/constle/\.github/workflows/release\.yaml@refs/tags/v' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
checksums.txt
sha256sum --check --ignore-missing checksums.txt
The two --certificate-* flags are not optional. Keyless signing has no fixed public key: anyone can obtain a valid Fulcio certificate and sign anything. Without pinning the identity, cosign will report Verified OK for a file signed by a complete stranger — all that proves is that somebody signed it. Pinning to constle/constle's release.yaml on a v* tag, issued by GitHub's OIDC issuer, is what turns the signature into "this came from the Constle release workflow."
Each archive also carries a SLSA build-provenance attestation: