CLI reference

The Community Edition’s sidecar is edssa-server-ce. The workspace also builds edssa-client (a token-minting load client, useful for smoke-testing a CE sidecar) and edssa-admin (an operator CLI oriented at the Enterprise edssa-proxy). All three are source-built today (cargo build --release -p <crate>) and will publish to Cargo / Homebrew alongside the v1.0.0-ce release.

edssa-server-ce

The CE verifier sidecar. Reads its config from environment variables (Config reference) and a single TOML manifest at the path EDSSA_CE_MANIFEST points to.

edssa-server-ce

There are no positional arguments and no flags — every behaviour is driven by env / manifest so the binary works equivalently in a container, a systemd unit, a Helm chart, or a bare-shell launch.

Exit codes

The first 401 in the error stream names the violated CE constraint

• a https://docs.edssa.io/ce#... pointer.

Endpoints

Per ADR-006, production 401 bodies are intentionally empty so the verifier doesn’t leak which check failed.

edssa-client (token-minting load client)

Source-built today (cargo run -p edssa-client); ships as a released binary via Homebrew tap + GitHub Releases in the operator-side Phase-8 publication step.

edssa-client is a traffic client, not a one-shot minter: it constructs --count tokens against a fleet seed, POSTs each to --target with the X-EdSSA-Token header, records per-request latency in an HdrHistogram, and prints a summary. It exits non-zero if any request was rejected (unless --fail-fast stopped the run on the first reject). Use it to smoke-test a running sidecar.

edssa-client \
  --target http://127.0.0.1:8080/ \
  --fleet  c1b2-demo \
  --seed   secrets/fleet-c1b2-demo.seed \
  --shape  phase2 \
  --width-n 64 --chaff-c 16 --threshold-t 33 \
  --count  100

Flags

CE note. The CE binary pins width_N = 64 and ships static (un-ratcheted) state, so the CE-matching invocation is --shape phase2 --width-n 64 --ratchet-step 0 with --chaff-c / --threshold-t matching your manifest preset (e.g. balanced → --chaff-c 16 --threshold-t 33). The header is assembled by the client as <fleet>-<hex> per ADR-012; there is no separate “print the token” mode.

edssa-admin (operator CLI)

The operator CLI for managing fleets and inspecting on-box state. It is part of the same source tree but is oriented at the Enterprise edssa-proxy deployment: it edits a multi-fleet fleets.toml manifest (preserving operator comments and key order), validates it, and signals the running proxy with SIGHUP.

In CE the manifest (EDSSA_CE_MANIFEST) is loaded once at boot and edssa-server-ce does not handle SIGHUP, so the manifest-mutation and reload subcommands do not apply to a CE sidecar — to change a CE fleet you edit ce.toml and restart the binary (see the Operator runbook). The read-only inspection subcommands (verify-anchor, verify-inclusion, trigger, tenants, usage, compute-fingerprint, compliance-export, transparency-publish) operate on Enterprise audit / multi-tenant state and are documented in full on the Enterprise docs; they are listed here for completeness so the surface matches the shipped binary.

Source-built today (cargo run -p edssa-admin -- <args>); ships as a released binary alongside the Phase-8 publication step.

Global flags

Subcommands (as shipped)

The verify-anchor --against-witness rekor and transparency-publish paths require the binary to be built with --features rekor; without it they exit with a “rebuild with --features rekor” hint. None of these inspect or mutate CE sidecar state — they read Enterprise audit / tenant stores.