bundle

treeship bundle create

Create a bundle from a list of artifacts.

treeship bundle create --artifacts art_a1b2,art_c3d4 --tag v1.0

Options

treeship bundle export

Export a bundle to a portable .treeship file. The id is the bundle bundle create minted, not one of the artifacts inside it; exporting an action or receipt id is refused with is application/vnd.treeship.action.v1+json, not a bundle.

treeship bundle export art_f7e6d5c4 --out chain.treeship

The export carries the signed bundle envelope and every artifact's DSSE envelope, with their signatures. It carries no public keys: the importer verifies each envelope against the trust roots pinned on their machine, never against a key the file supplied. Before importing, the recipient pins the producer's keys with the lines treeship keys export prints.

treeship bundle import

Import a .treeship file into your local artifact store.

treeship bundle import chain.treeship

✓ imported 4 artifacts from chain.treeship
  chain integrity: verified

Every envelope must verify against a pinned trust root, or the import is refused and names the key:

✗ envelope 2 is signed by key_agent_9c1e…, which is not a pinned trust root on this machine.
  Ask the producer for the line `treeship keys export` prints for that key and run it here:
    treeship trust add key_agent_9c1e… ed25519:<their public key> --kind agent_cert --agent agent://<their agent> --yes

An agent-signed envelope needs the agent's own key pinned under agent_cert; a ship-signed one needs the ship's key under cert_issuer.

Bundle format

A .treeship export is one JSON document:

{
  "version": 1,
  "bundle":    { "payloadType": "…/bundle", "payload": "…", "signatures": [{ "keyid": "key_…", "sig": "…" }] },
  "artifacts": [ { "payloadType": "…", "payload": "…", "signatures": [ … ] }, … ]
}

bundle is the signed bundle envelope (artifact list, chain order, metadata); artifacts are the DSSE envelopes it names, in order. There is no public key in the file.