id = "codesign"
name = "codesign"
description = "Create and manipulate code signatures."
executables = ["codesign"]
platforms = ["macos"]

[commands]
format = 1
label = "Sign or verify code"
description = "Sign code with an identity, or verify/display an existing signature. Requirements, detached signatures and timestamp options are left out."
quality = "ai-draft"
base = "fig:codesign"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/codesign.ts"
license = "MIT"

[[commands.field]]
id = "identity"
label = "Signing identity"
description = "Certificate name or hash; - for ad-hoc signing."
type = "string"
option = ["--sign", "-s"]
suggestions = [{ value = "-", label = "Ad-hoc" }]
sources = ["fig"]

[[commands.field]]
id = "force"
label = "Replace existing signature"
type = "boolean"
option = ["--force", "-f"]
effect = "overwrite"
sources = ["fig"]

[[commands.field]]
id = "deep"
label = "Include nested code"
type = "boolean"
option = ["--deep"]
sources = ["fig"]

[[commands.field]]
id = "options"
label = "Option flags"
description = "e.g. runtime for the hardened runtime."
type = "string"
option = ["--options", "-o"]
suggestions = [{ value = "runtime", label = "Hardened runtime" }]
sources = ["fig"]

[[commands.field]]
id = "entitlements"
label = "Entitlements file"
type = "path"
option = ["--entitlements"]
path = { kind = "file", role = "input", must_exist = true }
sources = ["fig"]

[[commands.field]]
id = "identifier"
label = "Identifier"
type = "string"
option = ["--identifier", "-i"]
sources = ["fig"]

[[commands.field]]
id = "keychain"
label = "Keychain"
type = "path"
option = ["--keychain"]
path = { kind = "file", role = "input", must_exist = true }
sources = ["fig"]

[[commands.field]]
id = "verify"
label = "Verify"
type = "count"
option = ["--verify", "-v"]
sources = ["fig"]

[[commands.field]]
id = "display"
label = "Display signature info"
type = "boolean"
option = ["--display", "-d"]
sources = ["fig"]

[[commands.field]]
id = "paths"
label = "Code paths"
type = "path"
position = 0
multiple = true
min = 1
path = { kind = "any", role = "input", must_exist = true, transforms = ["dot_slash_if_dash"] }
sources = ["fig"]

[[commands.task]]
id = "sign"
label = "Sign"
fields = ["identity", "options", "entitlements", "force", "deep", "paths"]
required = ["identity", "paths"]

[[commands.task]]
id = "verify"
label = "Verify signature"
fields = ["verify", "deep", "paths"]
required = ["verify", "paths"]
set = { verify = [2] }

[[commands.task]]
id = "display"
label = "Display signature"
fields = ["display", "verify", "paths"]
required = ["display", "paths"]
set = { display = [true], verify = [4] }

[[commands.group]]
id = "basic"
label = "Basic"
fields = ["identity", "paths", "verify", "display"]

[[commands.group]]
id = "advanced"
label = "Advanced"
fields = ["force", "deep", "options", "entitlements", "identifier", "keychain"]