Commands / kosa8 snapshot export

kosa8 snapshot export

Write a snapshot to an encrypted bundle for removable media or one-way transfer

Usage

kosa8 export SNAPSHOT -o FILE

Writes the snapshot as a single tar bundle whose every part is encrypted with AES-256-GCM: memory state, disks and manifest. A snapshot that is not encrypted at rest is encrypted on the way out; the local copy is left as it is.

The bundle carries its data key wrapped under this machine's KEK, so it opens only where that KEK has been imported (kosa8 key export / kosa8 key import). -o - writes to stdout, for a transfer tool that reads a stream.

A labelled snapshot above the floor level is exported only if the org policy lists "export" among its label's destinations; the daemon records it. The bundle's plaintext header carries the label, the banner and the CUI designation indicator from the policy.

--incremental writes a chunked bundle (kosa8-chunked-bundle/1) instead: the snapshot cut into content-defined chunks, of which only those the receiver is believed to lack are included — chunks in every --base snapshot it holds, and with --peer, in every bundle already written for that receiver. Made for a data diode or removable media, where the receiver cannot be asked what it has. The bundle is signed with this host's key and the receiver checks every chunk; see docs/design/edge-sync.md. A receiver on a kosa8 from before chunked bundles refuses one and says to upgrade.

Options