{ "commands": { "attach": { "aliases": [], "args": { "image-uri": { "description": "fully qualified URI to the image", "name": "image-uri", "required": true } }, "description": "attach an attestation to a container image", "examples": [ "<%= config.bin %> <%= command.id %> --attestation {:|@}" ], "flags": { "attestation": { "description": "attestation bundle to attach", "name": "attestation", "required": true, "hasDynamicHelp": false, "multiple": false, "type": "option" }, "username": { "char": "u", "dependsOn": [ "password" ], "description": "username for the registry", "name": "username", "required": false, "hasDynamicHelp": false, "multiple": false, "type": "option" }, "password": { "char": "p", "dependsOn": [ "username" ], "description": "password for the registry", "name": "password", "required": false, "hasDynamicHelp": false, "multiple": false, "type": "option" } }, "hasDynamicHelp": false, "hiddenAliases": [], "id": "attach", "pluginAlias": "@sigstore/cli", "pluginName": "@sigstore/cli", "pluginType": "core", "strict": true, "enableJsonFlag": false, "isESM": false, "relativePath": [ "dist", "commands", "attach.js" ] }, "attest": { "aliases": [], "args": { "file": { "description": "file to attest", "name": "file", "required": true } }, "description": "attest the supplied file", "examples": [ "<%= config.bin %> <%= command.id %> ./statement.json" ], "flags": { "json": { "description": "Format output as json.", "helpGroup": "GLOBAL", "name": "json", "allowNo": false, "type": "boolean" }, "fulcio-url": { "description": "URL to the Sigstore PKI server", "name": "fulcio-url", "required": false, "default": "https://fulcio.sigstore.dev", "hasDynamicHelp": false, "multiple": false, "type": "option" }, "rekor-url": { "description": "URL to the Rekor transparency log", "name": "rekor-url", "required": false, "default": "https://rekor.sigstore.dev", "hasDynamicHelp": false, "multiple": false, "type": "option" }, "tsa-server-url": { "description": "URL to the Timestamping Authority", "name": "tsa-server-url", "required": false, "hasDynamicHelp": false, "multiple": false, "type": "option" }, "tlog-upload": { "description": "whether or not to upload entry to the transparency log", "name": "tlog-upload", "required": false, "allowNo": true, "type": "boolean" }, "oidc-client-id": { "description": "OIDC client ID for application", "name": "oidc-client-id", "required": false, "default": "sigstore", "hasDynamicHelp": false, "multiple": false, "type": "option" }, "oidc-client-secret": { "description": "OIDC client secret for application", "name": "oidc-client-secret", "required": false, "hasDynamicHelp": false, "multiple": false, "type": "option" }, "oidc-issuer": { "description": "OIDC provider to be used to issue ID token", "name": "oidc-issuer", "required": false, "default": "https://oauth2.sigstore.dev/auth", "hasDynamicHelp": false, "multiple": false, "type": "option" }, "oidc-redirect-url": { "description": "OIDC redirect URL", "env": "OIDC_REDIRECT_URL", "name": "oidc-redirect-url", "required": false, "hasDynamicHelp": false, "multiple": false, "type": "option" }, "payload-type": { "aliases": [ "type" ], "char": "t", "description": "MIME or content type to apply to the DSSE envelope", "name": "payload-type", "required": false, "default": "application/vnd.in-toto+json", "hasDynamicHelp": false, "multiple": false, "type": "option" }, "output-file": { "aliases": [ "output", "out" ], "char": "o", "description": "write output to file", "name": "output-file", "required": false, "hasDynamicHelp": false, "multiple": false, "type": "option" }, "timeout": { "description": "timeout in seconds for API requests", "name": "timeout", "required": false, "default": 5, "hasDynamicHelp": false, "multiple": false, "type": "option" } }, "hasDynamicHelp": false, "hiddenAliases": [], "id": "attest", "pluginAlias": "@sigstore/cli", "pluginName": "@sigstore/cli", "pluginType": "core", "strict": true, "enableJsonFlag": true, "isESM": false, "relativePath": [ "dist", "commands", "attest.js" ] }, "initialize": { "aliases": [ "init" ], "args": {}, "description": "initialize the Sigstore TUF root to retrieve trusted certificates and keys for verification", "examples": [ "<%= config.bin %> <%= command.id %>" ], "flags": { "mirror": { "description": "URL to the Sigstore TUF repository", "name": "mirror", "default": "https://tuf-repo-cdn.sigstore.dev", "hasDynamicHelp": false, "multiple": false, "type": "option" }, "root": { "description": "path to the initial trusted root. Defaults to the embedded root.", "name": "root", "hasDynamicHelp": false, "multiple": false, "type": "option" }, "cache-path": { "description": "Absolute path to the directory to be used for caching downloaded TUF metadata and targets", "name": "cache-path", "hasDynamicHelp": false, "multiple": false, "type": "option" }, "force": { "description": "force initialization even if the cache already exists", "name": "force", "allowNo": false, "type": "boolean" } }, "hasDynamicHelp": false, "hiddenAliases": [], "id": "initialize", "pluginAlias": "@sigstore/cli", "pluginName": "@sigstore/cli", "pluginType": "core", "strict": true, "enableJsonFlag": false, "isESM": false, "relativePath": [ "dist", "commands", "initialize.js" ] }, "token": { "aliases": [], "args": {}, "description": "retrieve an OIDC token", "examples": [ "<%= config.bin %> <%= command.id %>" ], "flags": { "issuer": { "description": "OIDC provider to be used to issue ID token", "name": "issuer", "required": true, "default": "https://oauth2.sigstore.dev/auth", "hasDynamicHelp": false, "multiple": false, "type": "option" }, "client-id": { "description": "OIDC client ID", "name": "client-id", "required": true, "default": "sigstore", "hasDynamicHelp": false, "multiple": false, "type": "option" }, "client-secret": { "description": "OIDC client secret", "name": "client-secret", "required": false, "hasDynamicHelp": false, "multiple": false, "type": "option" }, "redirect-url": { "description": "OIDC redirect URL", "env": "OIDC_REDIRECT_URL", "name": "redirect-url", "required": false, "hasDynamicHelp": false, "multiple": false, "type": "option" } }, "hasDynamicHelp": false, "hidden": true, "hiddenAliases": [], "id": "token", "pluginAlias": "@sigstore/cli", "pluginName": "@sigstore/cli", "pluginType": "core", "strict": true, "enableJsonFlag": false, "isESM": false, "relativePath": [ "dist", "commands", "token.js" ] }, "verify": { "aliases": [], "args": { "bundle": { "description": "bundle to verify", "name": "bundle", "required": true } }, "description": "verify the supplied .sigstore bundle file", "examples": [ "<%= config.bin %> <%= command.id %> ./bundle.sigstore" ], "flags": { "json": { "description": "Format output as json.", "helpGroup": "GLOBAL", "name": "json", "allowNo": false, "type": "boolean" }, "tlog-threshold": { "description": "number of transparency log entries required to verify", "name": "tlog-threshold", "default": 1, "hasDynamicHelp": false, "multiple": false, "type": "option" }, "ctlog-threshold": { "description": "number of certificate transparency log entries required to verify", "name": "ctlog-threshold", "default": 1, "hasDynamicHelp": false, "multiple": false, "type": "option" }, "certificate-issuer": { "description": "Value that must appear in the signing certificate's issuer extension (OID 1.3.6.1.4.1.57264.1.1 or 1.3.6.1.4.1.57264.1.8). Not verified if no value is supplied", "name": "certificate-issuer", "hasDynamicHelp": false, "multiple": false, "type": "option" }, "certificate-identity-email": { "dependsOn": [ "certificate-issuer" ], "description": "Email address which must appear in the signing certificate's Subject Alternative Name (SAN) extension. Not verified if no value is supplied", "exclusive": [ "certificate-identity-uri" ], "name": "certificate-identity-email", "hasDynamicHelp": false, "multiple": false, "type": "option" }, "certificate-identity-uri": { "dependsOn": [ "certificate-issuer" ], "description": "URI which must appear in the signing certificate's Subject Alternative Name (SAN) extension. Not verified if no value is supplied", "exclusive": [ "certificate-identity-email" ], "name": "certificate-identity-uri", "hasDynamicHelp": false, "multiple": false, "type": "option" }, "tuf-mirror-url": { "description": "Base URL for the Sigstore TUF repository", "name": "tuf-mirror-url", "hasDynamicHelp": false, "multiple": false, "type": "option" }, "tuf-root-path": { "description": "Path to the initial trust root for the TUF repository", "name": "tuf-root-path", "hasDynamicHelp": false, "multiple": false, "type": "option" }, "tuf-cache-path": { "description": "Absolute path to the directory to be used for caching downloaded TUF metadata and targets", "name": "tuf-cache-path", "hasDynamicHelp": false, "multiple": false, "type": "option" }, "tuf-force-cache": { "description": "Whether to give precedence to cached, un-expired TUF metadata and targets over remote versions", "name": "tuf-force-cache", "required": false, "allowNo": false, "type": "boolean" }, "blob-file": { "description": "File containing data to verify. Only required if bundle was not signed using attest", "exclusive": [ "blob" ], "name": "blob-file", "hasDynamicHelp": false, "multiple": false, "type": "option" }, "blob": { "description": "Base64 encoded data to verify. Only required if bundle was not signed using attest", "exclusive": [ "blob-file" ], "name": "blob", "hasDynamicHelp": false, "multiple": false, "type": "option" } }, "hasDynamicHelp": false, "hiddenAliases": [], "id": "verify", "pluginAlias": "@sigstore/cli", "pluginName": "@sigstore/cli", "pluginType": "core", "strict": true, "enableJsonFlag": true, "isESM": false, "relativePath": [ "dist", "commands", "verify.js" ] } }, "version": "0.10.3" }