lean-pkg comparator

comparator receipts: attach one to a gated package, or check it; config (write a configuration from claims), coverage, migrate-signoff; host-check.

Usage

lean-pkg comparator [--json] COMMAND

Subcommands

lean-pkg comparator attach: attach a comparator receipt to a gated package; no status change (comparator NAME --receipt R is the same)
lean-pkg comparator check: validate a comparator receipt against the package; read-only, records nothing, works at any status (comparator NAME --receipt R --check is the same)
lean-pkg comparator config: write a comparator configuration from claims (–from-claims); coverage and migrate-signoff are verbs of their own
lean-pkg comparator coverage: read-only: the claims covered by the comparator configuration tracked at the gate-bound commit, and why a changed one needs a new gate (comparator config --coverage NAME is the same)
lean-pkg comparator migrate-signoff: move the deprecated inline judged_as / lean_pkg_scaffold keys of a configuration into lean-pkg-signoff.json; dry run unless –write (comparator config --migrate-signoff PATH is the same)
lean-pkg comparator host-check: can this host run the comparator; read-only

Details

The comparator tier: comparator attach records a comparator receipt on a gated package, comparator check validates one without recording it, comparator config drafts a configuration from the claims, comparator coverage reports what the configuration at the gate-bound commit covers, comparator migrate-signoff moves deprecated inline sign-off keys into lean-pkg-signoff.json, and comparator host-check asks whether this machine can run the comparator. The receipt itself is written by receipt comparator (the comparator-receipt program). Before 1.0, comparator NAME --receipt R attached, --check validated, and config --coverage / --migrate-signoff were modes of config; those spellings keep working (aliases). See The comparator tier.

Exit codes

0 success (dry runs and no-ops included), 1 refused or failed, 2 usage error; see Exit codes.