Export and enroll a signed build-id index

stella binary export-index downloads the current Vulnerabilities hub build-id artifact and signs a small descriptor using the enrolled generic-dsse purpose key for the selected CLI tenant. It needs the existing advisory:read capability, hub URL/authentication configuration and signing-key custody. It accepts no raw key or algorithm override and generates no fallback key.

stella binary export-index --output-directory ./artifacts/build-id-index-20260911

The output directory must be new. The command streams the download to a sibling staging directory, checks the format declaration, computes SHA-256 and length through Stella cryptography, signs the descriptor and atomically renames the directory. A denied request, missing key, malformed or interrupted download, signing failure or destination collision returns a nonzero exit without publishing a partial directory.

File	Content
`index.ndjson`	The exact owner-exported build-id to package/component rows, headed by `# stellaops-build-id-index: v1`.
`index.dsse.json`	A DSSE envelope with payload type `application/vnd.stellaops.build-id-index.manifest.v1+json`. Its bounded JSON descriptor contains `kind: stellaops.binary-build-id-index`, `formatVersion: 1`, byte `length` and lowercase `sha256`.
`public-jwks.json`	Public enrollment material from the configured signer, with explicit key ID, algorithm and verify-only usage. It contains no private key.

The CLI uses StellaOps:VulnerabilitiesUrl (STELLAOPS_VULNERABILITIES_URL) or the shared StellaOps:BackendUrl gateway fallback. Its authenticated read is GET /api/vulnerabilities/v1/binaries/build-id-index; see the owner API contract. The selected tenant determines signing custody only; the hub corpus is tenant-free.

Consumer trust is provisioned separately

The public file beside the artifact is not automatically trusted. Validate its provenance through the installation’s operator enrollment process, then provision the approved public trust file independently of artifact delivery. Scanner resolves it through Crypto:SignatureTrust:JwksFiles:binary-build-id-index.

{
  "Crypto": {
    "SignatureTrust": {
      "JwksFiles": {
        "binary-build-id-index": "/etc/stellaops/trust/build-id-index.jwks.json"
      }
    }
  },
  "Scanner": {
    "Worker": {
      "NativeAnalyzers": {
        "BuildIdIndex": {
          "IndexPath": "/var/lib/stellaops/build-id-index/index.ndjson",
          "RequireSignature": true
        }
      }
    }
  }
}

The default signature sidecar is index.dsse.json; SignaturePath can select an explicit path. Scanner verifies the descriptor against the purpose trust, then hashes the same stream it parses before installing the index. Wrong trust, altered bytes, length or format disagreement refuse the index. The artifact provides build-id package identity lookup; its rows do not assert CVE applicability or a backport verdict.