cloudtaser-cli source host-launch¶
Verify a public host approval and the signed Port release, then clone the active source catalog's exact grants into one immutable, expiring launch role. Run this command as the host administrator over an independently authenticated management channel. The administrator token arrives only through an inherited private pipe. One no-restart systemd service receives its response-wrapped credential through a separate inherited pipe after independent process checks.
The command remains attached to the service until it exits or the approval or command timeout ends. Disconnect, RAM loss, partial issuance, or process restart requires a fresh administrator approval with a new launch ID. Standard output contains only a public authentication receipt, which is not a readiness claim. Every cloned grant expires at the earlier of its original deadline and the launch deadline. SecretID TTL is cleanup eligibility, not an authentication cutoff. For early retirement, stop issuers and run source host-launch revoke, then source authority revoke-tokens for every fingerprint in the old catalog.
Usage¶
Flags¶
| Flag | Type | Default | Required | Description |
|---|---|---|---|---|
--admin-token-fd |
int | -1 |
no | private inherited administrator token input pipe, descriptor 3 or higher |
--approval-file |
string | (empty) |
no | public exact host approval, including signed Port version and executable digest |
--help, -h |
bool | false |
no | help for host-launch |
--timeout |
duration | 20m0s |
no | maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env) |