Trust Profiles

Audience: Operators and release engineers who verify Stella Ops bundles offline. Scope: What trust profiles are, where they live, how they are structured, and the stella trust-profile commands that apply them into a local trust store.

Trust profiles are offline trust-store templates for bundle verification. Each profile bundles the trust roots, Rekor public keys, and TSA roots needed to verify a signed Stella Ops bundle into a single file, so operators can apply a complete, compliance-approved trust store with one command — including on air-gapped hosts.

Profile location

Default profiles: etc/trust-profiles/*.trustprofile.json
Assets referenced by profiles: etc/trust-profiles/assets/

Override the lookup directory with the --profiles-dir <path> flag, or set the STELLAOPS_TRUST_PROFILES environment variable to change the default search location.

Profile structure

Field	Description
`profileId`	Stable identifier referenced by the CLI commands.
`trustRoots[]`	Signing trust roots (PEM files).
`rekorKeys[]`	Rekor public keys for offline inclusion-proof verification.
`tsaRoots[]`	TSA roots for RFC 3161 timestamp verification.
`metadata`	Optional compliance metadata.

CLI commands

Command	Purpose
`stella trust-profile list`	List the available profiles.
`stella trust-profile show <profile-id>`	Show the resolved contents of a profile.
`stella trust-profile apply <profile-id> --output <dir>`	Materialize a profile into a local trust store.

Apply output

stella trust-profile apply writes a self-contained trust store to the --output directory:

Artifact	Description
`trust-manifest.json`	Trust-roots manifest for offline verification.
`trust-profile.json`	Resolved copy of the applied profile.
`trust-root.pem`	Combined trust roots, ready to pass to `stella bundle verify`.
`trust-roots/`, `rekor/`, `tsa/`	Folders containing the PEM assets.

Example workflow

Apply the global profile and verify a bundle against the resulting trust store:

stella trust-profile apply global --output ./trust-store
stella bundle verify --trust-root ./trust-store/trust-root.pem

Note: The default profiles ship with placeholder roots for scaffolding only. Replace them with compliance-approved roots before production use.