outboundctl feed

Before you publish a managed rule feed to the Macs your organisation manages, check it. outboundctl feed check uses the app’s feed validator, and prints the number of rules it would install:

outboundctl feed check <file|https-url> [--pin <sha256>]

The target is a path to a feed file or an https address. A file is checked as it stands; an address is downloaded first. Nothing is installed: the command validates and reports, it never touches the rule store.

What is checked

The command checks the pin’s syntax before reading or downloading the feed. A URL target must use https. A pin must contain 64 hexadecimal digits; surrounding whitespace, case and an optional sha256: prefix are normalised. The digest must match the SHA-256 of the bytes. Then the file must be the same JSON envelope the rule store uses, with a schema version this build understands; it may carry at most 50,000 rules; every rule needs its own id, a repeat fails the whole feed; lifetimes must be forever, a date or a schedule (a lifetime bound to a session or a process, such as until quit or until restart, means nothing on another Mac and is refused); and every rule must be one the filter could actually match, with the error naming the rule’s index, id and field.

Exit codes

Code	When
0	The feed is valid; the rule count was printed
65	The feed is not valid: not https, wrong schema version, too many rules, malformed, or the pin does not match
65	The pin itself is malformed (not 64 hexadecimal digits)
1	The file could not be read, or the address could not be downloaded

The signing commands exit 65 for a feed, key or signature that is not valid, and 66 when a file is missing.

For a local feed file (see also MDM deployment):

outboundctl feed check rule-feed.json

A local file check does not test the URL where you later publish that file. The CLI also does not supply the Mac’s known profiles for validation, so it cannot warn about unknown profile IDs. Missing arguments or unsupported flags exit 64.

Signing a feed

When your profile forces RuleFeedPublicKeys, every Mac accepts only a feed signed by one of those keys. The signing workflow is described in Signing your feed; these are the commands.

outboundctl feed keygen --out feed-signing.key
outboundctl feed sign --key feed-signing.key rule-feed.json
outboundctl feed verify rule-feed.json --pubkey <base64>

Command	What it does
feed keygen --out <file>	Creates an Ed25519 key pair. The private key is written to the file, readable only by you, and an existing file is never overwritten. The public key and its key id are printed: the public key is what you put in RuleFeedPublicKeys
feed sign --key <file> <feed.json>	Signs the exact bytes of the feed and writes the signature next to it as <feed.json>.sig. The feed must carry a valid envelope that has not expired. The key file must not be readable by its group or others
feed verify <feed.json> --pubkey <base64>	Checks the signature in <feed.json>.sig and the envelope, as a Mac would, and prints the feed version, key id, issue date, expiry and rule count

Edit the feed after signing and the signature no longer matches; sign it again before you publish.

What is installed

outboundctl feed status [--json]

Shows the configured feed address, whether the installed feed was verified and by which key, its version and the newest version this Mac has accepted, when it was issued and when it expires, when it was installed and last checked, the rule count, whether its targets include this Mac, the last error and the kept versions. With no feed configured, it prints “No organization rule feed is configured (RuleFeedURL).”

Rolling back

outboundctl feed rollback [--to <version>]

Reinstalls a signed feed kept on this Mac: the newest one older than the installed feed, or the version you name. Its signature is checked again against today’s RuleFeedPublicKeys. A Mac never accepts an older version from the server, so this is the only way back, and it works only while a configuration profile forces RuleFeedAllowRollback to true; otherwise it exits 77, even as root. The rolled-back feed stays installed until the publisher issues a version newer than any this Mac has accepted, its expiry passes, or RuleFeedAllowRollback is no longer forced.