TALER-AUDITOR-OFFLINE(1)

📦 version 1.3.0, in nixos 26.05, nixpkgs unstable

💅 TALER-AUDITOR-OFFLINE(1) — the GNU Taler manual page, bestie edition 🎀

okay so this is taler-auditor-offline, straight out of the GNU Taler fam — and it's the tool an auditor uses to be like "yes, I see these keys, I'm on it." ✨

✨ NAME ✨

taler-auditor-offline — the Taler auditor certifies that it audits a Taler exchange. That's the whole vibe. 👑

🦋 SYNOPSIS 🦋

taler-auditor-offline [-c FILENAME | --config=FILENAME] [-h | --help]
[-L LOGLEVEL | --loglevel=LOGLEVEL] [-l FILENAME | --logfile=FILENAME]
[-v | --version] [subcommand ...]

literally just options and then as many subcommands as your heart desires 🫶

🌸 DESCRIPTION 🌸

taler-auditor-offline is a command-line tool for an auditor to sign that he is aware of certain keys being used by an exchange. By signing, the auditor affirms that he will verify that the exchange is properly accounting for coins of those denominations. Not me being the accountability main character 😭👑

The tool takes a list of subcommands as arguments, and they get processed sequentially. One after another. In order. No jumping the queue. 💅

There are two subcommands that go online and talk to the exchange's REST APIs:

  • download — pulls the current public keys from the running exchange. Important caveat bestie: this only includes keys that the exchange operator has previously validated using the taler-exchange-offline tool. The resulting data serves as input to the sign and show subcommands.
  • upload — uploads the signatures you created with the private key to the exchange. It handles the output of all subcommands (except download, obviously).

download and upload must naturally be run "online" — and dw, they do not require access to the auditor's private key, which should be kept offline. Keep that thing in a vault, fr fr 🔐

All the other subcommands are meant to be run "offline." But like — especially when testing — it's of course possible to run them online too, no gatekeeping. Generally, subcommands read inputs (beyond command-line arguments) from stdin. They may also consume outputs of previous subcommands, which is kind of iconic. The outputs of multiple subcommands are automatically combined, and if they're not consumed, the final output gets printed to stdout. Slay. ✨

The general options for taler-auditor-offline are:

  • -c FILENAME | --config=FILENAME — Use the configuration and other resources for the merchant to operate from FILENAME.
  • -h | --help — Print short help on options. tiny lil lifeline 🫶
  • -L LOGLEVEL | --loglevel=LOGLEVEL — Specifies the log level to use. Accepted values are: DEBUG, INFO, WARNING, ERROR.
  • -l FILENAME | --logfile=FILENAME — Send logging output to FILENAME.
  • -v | --version — Print version information.

🎀 CONFIGURATION 🎀

Both the exchange and the taler-auditor-httpd must be given the auditor's public key, so they can validate messages signed by the auditor. To obtain the auditor's public key, use:

$ taler-auditor-offline setup

Heads up: if the private key file already exists, the above will simply output the existing key. And passing additional arguments after setup (including "-") will cause the output to be encapsulated in JSON. cute little toggle 💖

Relevant configuration options for taler-auditor-offline are:

  • [auditor/AUDITOR_PRIV_FILE] --- where to store the private key
lowkey the single most important path on this whole page, protect it with your life 🫶

🌈 SUBCOMMANDS 🌈

🧚 setup

When run the first time, this subcommand sets up the offline private key and outputs the resulting public key. Subsequent invocations will simply again output the (same) public key — in the format usable for the exchange configuration. It's giving "do it once, then it's just vibes." ✨

🦋 download

This subcommand must be run online. It downloads future signing and denomination keys with the associated meta data from the exchange, and outputs the resulting JSON (for consumption by subsequent subcommands, or to stdout).

💜 show

This subcommand outputs information about future signing and denomination keys, for manual checking against the business-approved fee structure, lifetimes and other parameters. The manual-checking part is kind of the whole point, ngl 👀

It consumes the output of the download subcommand, either from stdin or directly.

Its output always goes to stdout for human consumption (not in JSON). Also: it is usually a bad idea (but possible) to combine show with other subcommands — except maybe for testing. Like, you can, but... bestie. 😭

🔥 sign

This subcommand signs information about future signing and denomination keys.

It consumes the output of the download subcommand, either from stdin or directly.

It outputs the signatures over all denomination and signing keys present in the input, in a format suitable for the upload subcommand. This is the one with the private key energy — treat it accordingly 👑

⭐ upload

This subcommand uploads outputs from other subcommands (except download and show) to the exchange. Note that it is possible that some uploads succeed while others fail, because the operation is not atomic. Not atomic, bestie — partial success is a real outcome, plan for it 💀

The subcommand takes no arguments and has no output.

🍓 help

This subcommand shows a summary of all available subcommands with the required arguments. When in doubt, ask for help. always. 🫶

🌸 EXAMPLES 🌸

💖 Download public keys from an exchange (online)

$ taler-auditor-offline download > keys.json

🎀 Show information about public keys (offline or online)

$ taler-auditor-offline show < keys.json

🦋 Sign public keys (offline)

$ taler-auditor-offline sign < keys.json > sigs.json

✨ Upload auditor signatures (online)

$ taler-auditor-offline upload < sigs.json

🔥 Download, sign and upload, all in one (online)

Note that doing this is only recommended in non-production deployments.
$ taler-auditor-offline download sign upload

one line, three subcommands, zero chill 💅 but fr, non-production only.

💀 SECURITY CONSIDERATIONS 💀

The taler-auditor-offline tool assumes that it is run on a high-security system — especially for the sign subcommand. Like, that's not a suggestion, that's the assumption. 🔐

The auditor should first use the show subcommand on the offline system to check that the keys being signed are acceptable. This process requires manual work: the auditor should check with the exchange operator that the keys (and meta data) match what was previously seen by the exchange operator when they used the taler-exchange-offline tool. Yes, actual human effort. No, you can't automate it away. 😌

👑 SEE ALSO 👑

taler-exchange-offline(1), taler-auditor.conf(5)

🙈 BUGS 🙈

Report bugs by using https://bugs.taler.net/ or by sending electronic mail to <taler@gnu.org>. They genuinely want to hear from you, so don't be shy 🫶

🌈 AUTHOR 🌈

GNU Taler contributors

2014-2025 Taler Systems SA (GPLv3+ or GFDL 1.3+)

okay that's the whole thing, you ate that ✨ version 1.0, dated Dec 22, 2025 — go forth and audit responsibly bestie 💖🦋

📦 where this page comes from