stella export cra-tech-file — Command Guide

Audience: compliance operators who assemble and verify a CRA Annex VII technical file bundle offline from frozen local evidence.

stella export cra-tech-file creates a deterministic CRA Annex VII technical file bundle from a frozen local JSON input file. stella verify cra-tech-file verifies the bundle offline by replaying archive checksums, section hashes, the index schema, and the local DSSE HMAC signature over index.json.

The commands do not fetch remote evidence and do not claim CAdES or durable Attestor audit signing. Those production signing paths remain separate from the file-backed offline HMAC verifier.

Export

stella export cra-tech-file \
  --product product:stella-ops \
  --since 2026-04-30 \
  --input ./cra/tech-file-input.json \
  --output ./out/stella-ops.cra-tech-file.tar.gz \
  --signing-key-file ./keys/cra-tech-file.hmac \
  --sign-with eu-local-cra-tech-file \
  --json

Flags:

• --product <ref>: Product reference written to index.json.
• --since <yyyy-MM-dd>: UTC evidence-window lower bound. The input generatedAt timestamp must be on or after this date.
• --input <file>: Local cra-tech-file-cli-input-v1 JSON file.
• --output <file>: Destination .tar.gz bundle path.
• --signing-key-file <file>: Local HMAC key file. If omitted, the command uses STELLAOPS_CRA_TECH_FILE_HMAC_KEY.
• --sign-with <id>: Local signing profile/key id recorded in the DSSE envelope. --signing-key-id is accepted as an alias.
• --overwrite: Allow replacing an existing output file.
• --json: Print deterministic command summary JSON.

Fail-closed export rules:

• Missing signing key material fails before writing output.
• --sign-with and --signing-key-id cannot both be supplied.
• Missing required CRA sections, missing evidence refs, malformed input JSON, or an input generatedAt earlier than --since fail before writing output.
• The generated bundle is verified locally before it is written as a successful export.

Verify

stella verify cra-tech-file ./out/stella-ops.cra-tech-file.tar.gz \
  --signing-key-file ./keys/cra-tech-file.hmac \
  --sign-with eu-local-cra-tech-file \
  --json

Verification uses only the archive bytes and the supplied local key material. A tampered section, mismatched checksum manifest, unsigned index, wrong key id, or invalid DSSE signature returns a verification failure exit code.

Input Schema

The input file binds frozen local evidence references to the adapter contract. All evidence refs should be immutable or content-addressed.

{
  "schemaVersion": "cra-tech-file-cli-input-v1",
  "generatedAt": "2026-04-30T10:00:00Z",
  "product": {
    "name": "Stella Ops",
    "version": "2026.04",
    "manufacturer": "Stella Ops",
    "description": "Self-hosted release control plane"
  },
  "release": {
    "version": "2026.04",
    "releaseManifestRef": "attestor://release-manifests/stella-2026.04",
    "sbomRef": "evidence://cra/sbom",
    "placedOnMarketAt": "2026-04-30",
    "supportUntil": "2031-04-30"
  },
  "evidenceRefs": [
    {
      "sectionId": "sbom",
      "kind": "sbom",
      "ref": "evidence://cra/sbom",
      "sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
      "mediaType": "application/json",
      "description": "Release SBOM"
    }
  ],
  "harmonisedStandards": [],
  "euDeclarationOfConformity": {
    "status": "draft",
    "manufacturerName": "Stella Ops",
    "manufacturerAddress": "TBD",
    "responsibleRole": "product-owner",
    "declarationRef": "docs/legal/cra-product-classification.md"
  },
  "supportPolicy": {
    "policyRef": "docs/europe/stella-supplier-security-statement.md",
    "supportWindow": "5-year minor-train security support baseline",
    "securityContactRef": "docs/product/security-contact.md",
    "placementAnchorRef": "docs/legal/cra-product-placement-anchor.md"
  },
  "sourceRefs": {
    "evidencePortableBundleRef": "evidence-locker://portable/release-2026.04",
    "releaseManifestRef": "attestor://release-manifests/stella-2026.04",
    "controlRegisterRef": "policy://control-registers/cra/stella-2026.04"
  },
  "techFileBlockers": []
}

The adapter still records explicit blockers for unavailable upstream evidence, such as a missing control-register reference. A signed, locally verified bundle means the deterministic bundle has not been altered and was signed by the local HMAC key supplied to the command; it is not a substitute for production CAdES-backed regulatory signing.

Related Documentation

• stella export — Command Guide — the full CLI export command surface and shared offline/determinism rules.
• CRA technical file pack — product-facing pack summary.
• CRA conformity dossier — the companion stella export conformity-dossier artifact.