id = "cosign"
name = "Cosign"
description = "Signing, verifying and key management for container images and blobs in the Sigstore project."
homepage = "https://docs.sigstore.dev/cosign/"
executables = ["cosign"]

[commands]
format = 1
label = "Cosign"
description = "Sign or verify a container image with a key pair, or generate a key pair. Keyless, KMS, attestation and registry utilities are left out."
quality = "ai-draft"
base = "fig:cosign"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/cosign.ts"
license = "MIT"
[[commands.subcommand]]
path = ["sign"]
label = "Sign an image"

[[commands.subcommand.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/cosign.ts"
license = "MIT"
[[commands.subcommand.field]]
id = "key"
label = "Private key"
type = "path"
path = { kind = "file", role = "input" }
option = ["--key"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "annotations"
label = "Annotations (key=value)"
type = "string"
option = ["--annotations", "-a"]
multiple = true
sources = ["fig"]

[[commands.subcommand.field]]
id = "recursive"
label = "Also sign each image of a multi-arch index"
type = "boolean"
option = ["--recursive", "-r"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "force"
label = "Skip warnings and confirmations"
type = "boolean"
option = ["--force", "-f"]
effect = "overwrite"
sources = ["fig"]

[[commands.subcommand.field]]
id = "image"
label = "Image reference"
type = "string"
position = 0
min = 1
sources = ["fig"]

[[commands.subcommand.task]]
id = "sign-key"
label = "Sign with a key"
fields = ["key", "image"]
required = ["key", "image"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["image", "key", "annotations", "recursive", "force"]

[[commands.subcommand]]
path = ["verify"]
label = "Verify an image signature"

[[commands.subcommand.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/cosign.ts"
license = "MIT"
[[commands.subcommand.field]]
id = "key"
label = "Public key"
type = "path"
path = { kind = "file", role = "input" }
option = ["--key"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "cert_email"
label = "Expected certificate email"
type = "string"
option = ["--cert-email"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "cert_oidc_issuer"
label = "Expected OIDC issuer"
type = "string"
option = ["--cert-oidc-issuer"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "output"
label = "Output format"
type = "enum"
option = ["--output", "-o"]
choices = [{ value = "json", label = "JSON" }, { value = "text", label = "Text" }]
sources = ["fig"]

[[commands.subcommand.field]]
id = "image"
label = "Image reference"
type = "string"
position = 0
min = 1
sources = ["fig"]

[[commands.subcommand.task]]
id = "verify-key"
label = "Verify with a public key"
fields = ["key", "output", "image"]
required = ["key", "image"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["image", "key", "cert_email", "cert_oidc_issuer", "output"]

[[commands.subcommand]]
path = ["generate-key-pair"]
label = "Generate a key pair"

[[commands.subcommand.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/cosign.ts"
license = "MIT"
[[commands.subcommand.field]]
id = "kms"
label = "KMS service"
description = "Create the key pair in a KMS instead of local files."
type = "string"
option = ["--kms"]
sources = ["fig"]

[[commands.subcommand.task]]
id = "local"
label = "Local key pair"
fields = []

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["kms"]