Skip to content

bifroest audit merge

Verifies every selected journal before producing one deterministic JSON Lines stream. Records are ordered by their producer-signed timestamp and stable origin and chain-position tie-breakers. Timestamps are statements by their producers and are not an independently trusted clock. Merge refuses inputs exceeding its bounded materialization safety limit.

Clear and encrypted journals can be merged together. The default JSON Lines output contains only public fields. To include private fields, supply --with-sensitive and the decryption identities for every encrypted source.

Syntax

bifroest audit merge [flags] <auditlogName>...

Arguments

auditlogName selects one or more configured audit logs by name, not segment paths. Each needs its signed head; Bifröst need not be stopped. Different journals are captured independently, not at one atomic instant.

Flags

Includes all general flags.

--configuration

-cFile Path

Configuration to load. It uses the same platform default as bifroest run.

--decryptionIdentityFile

File Path

Private SSH key required with --with-sensitive for encrypted event fields. Repeat for sources encrypted for different keys. Without --with-sensitive, supplied decryption identities are not loaded or used for the redacted merge.

--with-sensitive

bool = false

Explicitly include confidential event fields in the merged JSON Lines stream. The output is plaintext and must be protected.

--expectedProducerId

string

External trust anchor in the form <auditlogName>=<64-hex-producer-id>. Repeat for selected sources whose configured signing private keys must not be opened or are absent. Every mapping must name a selected source, and the values must come from independently trusted channels.

--output

File Path = "-"

Output file. - writes JSON Lines to stdout. The output file's immediate parent directory must already exist; the command does not create missing output directories. The parent is opened without following links where the platform supports it and remains pinned through the final safety check and atomic installation. Output paths inside any enabled configured journal or enabled recording repository, or aliasing a journal file, the loaded configuration file, a signing identity or a referenced encryption public-key file are rejected, including logs not selected for the merge. Supplied decryption identities are also protected. When stdout is a regular file, the command rejects descriptors pointing to protected files, including journal heads and segments; normal pipes remain supported. Shell redirection with > can truncate a file before the command starts, so do not redirect stdout to protected files.

--force

bool = false

Replaces an existing output file.

Example

Configure two offline journals named first and second, each with its own copied root, recipient public key (if encrypted), and absent signing identity file. Obtain FIRST_PRODUCER_ID and SECOND_PRODUCER_ID separately from independently trusted provisioning records, never from either journal. With both 64-hex variables already set, merge redacted events without copying either server signing key:

1
2
3
4
5
6
bifroest audit merge \
  --configuration /srv/audit-evidence/configuration.yaml \
  --expectedProducerId "first=${FIRST_PRODUCER_ID}" \
  --expectedProducerId "second=${SECOND_PRODUCER_ID}" \
  --output /srv/audit-output/merged.jsonl \
  first second

For a sensitive merge of encrypted sources, also supply --with-sensitive and the matching --decryptionIdentityFile for each recipient. Merged JSON Lines are unsigned and public envelope metadata still requires protection.