Skip to content
NOQTIS

noqtis-chain(1)

noqtis-chain — check an append-only chain of capsules

noqtis chain [-p key.pub] [--anchor der-file ...] [-j | --json] dir ...

A chain is a log of capsules to which a link is only ever added. Start it by sealing the first in format 2, and add each next one with the last as its only input:

$ noqtis seal --format 2 -k me log/1
$ noqtis seal -k me --input prev=log/1 log/2
$ noqtis seal -k me --input prev=log/2 log/3

The seal of each link then signs the id of the one before, so a link cannot be changed, removed or put in another place without the chain failing. noqtis chain checks the folders dir, oldest first: each link checks (as noqtis-check(1) with -p and --anchor), each after the first names exactly the one before it as its only input (a fork, a gap or links out of order fail), and every link is sealed by the same key. The first link's own inputs are not followed, so a chain can be checked from any link on. The last row is the chain's head: the last link's id (nqcapid(3)), which a reader can keep or publish to notice a chain cut back later.

key.pub
The key every link must be sealed by. Without it, the first link's own key is trusted, and a note says so.
der-file
A TSA root or issuing certificate (DER), up to 32, for timestamped seals.
, --json
The rows as JSON.

0
The chain checks.
1
A link does not check, does not follow the one before it, or is sealed by another key.
2
A usage error, or a folder that is not there.

noqtis-check(1), noqtis-seal(1), nqdchain(3), noqtis-capsule(5)