11. Reference
holger (the server)
holger --help lists the verbs a build has (server/cli/src/lib.rs). With no verb, holger does a first start (chapter 2). A verb whose feature is not in the build is not offered.
| verb | what it does | feature |
start --config <ron> |
start the server | |
dev-pair |
write and start the /cache + /sparring pair |
|
install add|update|remove|status|render, service … |
systemd unit | systemd |
intake advance|quarantine|release|block|state|evidence --server <grpc> |
the intake verbs over gRPC | intake |
audit trail|verify|query|aggregate|export |
the audit log (chapter 10) | |
export |
the signed airgap export of the approved set | secure_update |
export-push |
one push into export.push_to |
export-push |
bundle import|allow-first-import |
import a signed bundle; grant a first import (admin, audited, once) | |
scrub, backup create|verify|restore |
check the bundle store; back it up | |
intel build|import|status|scan |
the advisory database (chapter 5) | secure_update |
scanner-sigs build|status |
ClamAV and YARA signature bundles | secure_update |
sigstore-trust make|status |
the Sigstore trust root bundle | secure_update |
time-token make|status |
the signed time floor | secure_update |
repo-key create|show |
the apt/dnf repository signing key (chapter 10) | |
jobs --config <ron> |
where untrusted work runs, and with which protections | intake |
sync key|wg-key|invalidate|manifest|apply|ack|board|pull |
the sync protocol | sync |
pair downstream|upstream|repair|list |
mutual-TLS pairing records | |
recharge --main … |
rebuild a dead main from its twin | estate |
passkey whoami|invite|invites|revoke-invite|credentials|revoke-credential|revoke-sessions |
the people of the passkey door | |
token list|revoke|mint |
repository tokens | auth-passkey |
scan, sbom attach|fetch, properties set|get, promote |
scan a directory; SBOMs; properties; a local promotion | supply-chain |
retention, search, replicate, mirror, estate, fleet-enrol |
garbage collection; search; copy between stores; one mirror cycle (fetch); move a data root; join the ONE box (metered) |
holger-downstream is the same program built with the downstream feature: it has start, intake, audit, bundle, scrub, backup, sync, repo-key, pair, passkey, jobs and the like, and no export, intel, scan or token (server/cli/Cargo.toml, the downstream feature).
holger-cli (the client)
holger-cli dials only --at <host:port> (https:// unless it names this machine), with --token-file, --ca and --connect-to (holger-cli/src/cli.rs):
| verb | what it does |
login, logout, whoami, health, profile |
the session and the server |
repos, artifacts list|fetch|put, archive files|info, search |
repositories and artifacts |
intake list [--queue <q>]|state|evidence|advance |
the intake chain (chapter 5) |
intake sets [--status <s>], intake set <id>, intake set approve <id> --revision <rev> [--reason <why>], intake set refuse <id> --revision <rev> --reason <why> |
the dependency sets: list, show, approve or refuse a pull's whole closure as one (chapter 5) |
security, board, snapshot, flow [--json] [--open main|all] |
the console's views |
audit trail|downloads|query|aggregate|export|verify |
the audit plane |
jobs, admission usage|plan, usage, room show|private-estate |
jobs, admission, meters, room |
account mine|create|grant, token mint|list|revoke |
repositories and tokens of a person |
first-key [--display <name>] |
the first admin's single-use invite (admin only) |
downstream invite |
a signed downstream invite |
bundle prepare|approve|finalize|inspect|extract |
the offline bundle verbs; no server is dialled |
bundle export|allow-first-import|import, intel import |
the server's bundle and intel doors |
verify, agent |
the offline verifier; the courier |
sbom, property, promote, replicate, migration discover|start|watch|cancel |
the rest of the console's actions |
The console
holger-ui (repository nordisk/holger-ui, main 06b2f3c) only calls the server and draws. Its menu has one entry per job (src/util.rs, MENU; test every_page_sits_under_exactly_one_menu_entry):
| entry | what is under it |
Overview (/) |
the estate at a glance: what needs action, the boxes, the downstreams, the intake queue, the latest refusals, storage, sources, this server |
| Flow | the flow picture, the only picture (chapter 4) |
| Repositories | the repositories, an artifact, search, replicate, migrate in |
| Security | the intake queues, and one artifact's security view: its evidence, history and trail (src/pages/security.rs) |
| Account | the session, your repositories, your tokens (and a metered console's plan) |
| Admin | shown to an admin only: the public-site switch, then the panes Disks, Twin, Sync (with the sync board and the First import form), Growth, Clock, Plugins / Monetize, Logs, Queue, Admission, Invites and the front's certificates (src/admin.rs, PANES) |
HTTP doors
Every door outside a repository's path starts with /-/ (server/lib/src/exposed/http.rs). "Admin read" is an Admin or an Auditor.
| path | who |
GET /healthz |
anyone |
GET /readyz |
anyone (503 while not ready) |
GET /metrics |
the read gate; in the Critical profile loopback only |
GET /-/repo-key.asc, GET /-/evidence-key (.pem, .jwks, .crt), GET /-/twin |
anyone |
GET /-/flow, /-/flow.svg, /-/flow.json, /-/estate.json, /-/sandbox/probe |
admin read |
POST /-/intake/advance, GET /-/intake/state, /-/intake/evidence, /-/intake/sbom |
by duty (chapter 5) |
GET /-/intake/sets, /-/intake/set?id=, POST /-/intake/set/approve|refuse?id=&revision=&reason= |
by duty: the dependency sets (chapter 5) |
POST /-/bundle/import, POST /-/intel/import |
RepositoryAdmin or SecurityApprover |
POST /-/bundle/first-import?vendor=&product=&sequence= |
RepositoryAdmin |
GET /-/audit/trail, /-/audit/verify, /-/audit/downloads |
Auditor or Admin |
GET|PUT /-/settings/<name> |
Admin |
/-/auth/passkey/… |
the passkey doors: config, login/*, step-up/*, register/*, session, logout; invites, credentials, sessions/revoke-all for an admin |
GET /-/sync/key, /-/sync/manifest, POST /-/sync/ack |
an authenticated identity (the ack also its signature) |
GET /-/sync/board, /-/sync/downstreams |
Auditor or RepositoryAdmin |
POST /-/sync/downstreams/enrol|revoke|invite, /-/sync/upstreams/invite |
RepositoryAdmin |
GET /-/search, /-/sbom, /-/properties |
the read gate |
With an admin listener (ron_admin_url), the admin doors (/-/auth/, /-/bundle/, /-/intel/, /-/intake/, /-/audit/, /-/flow, /-/twin, /-/sandbox/ and the sync board, invalidate, apply, downstream and upstream doors) answer only there; on the other plane they answer holger-listen-3 (server/lib/src/listen.rs).
gRPC
The services are in proto/: holger.v1 (RepositoryService, ArchiveService, AdminService, PromotionService, AuditService, SearchService, SbomService, PropertyService, ReplicationService, MigrationService, UsageService, JobService, AdmissionService), holger.doors.v1 (BundleService, FirstKeyService, DownstreamService), holger.account.v1, holger.token.v1, holger.room.v1, holger.metered.v1, holger.estate.v1 and holger.grow.v1.
Metrics and counters
/metrics: Prometheus counters.- The flow picture's counters come from the audit index (chapter 4).
Error codes
Every refusal names a code in brackets, [holger-<area>-<n>], and the gRPC metadata and HTTP header x-holger-code carry it. The registry is errcode/src/lib.rs (crate holger-errcode): each code with its meaning and the file that raises it. Codes are never renumbered or reused. The areas:
| area | about |
update, airgap, import, export, sync, downstream, boundary |
bundles, the export, the import doors, the sync protocol, the one-way boundary |
intake, promote, duty, npm, oci, model |
the intake chain and its formats |
sandbox, scan, sigs, trust, provenance, attest |
the scan sandbox, evidence, scanner signatures, the Sigstore root, provenance |
auth, token, account, listen, tls, key, time |
sign-in, tokens, listeners, CRLs, key files, the time floor |
offline |
network: Offline (chapter 10) |
audit |
the audit log |
twin, peer, grow, metered, front, plugin, mvp |
the estate, pairing, growth, plans, the front page, wasm plugins, formats not built in |
server, storage, cli, jobs, admission, migration, marketplace |
the rest |
Some names from the scans are findings, not refusal codes: holger-no-ecosystem and the intel words HOLGER-INTEL-MISSING, HOLGER-INTEL-EXPIRED and HOLGER-INTEL-STALE (chapter 5).