id       = "keytool"
name     = "keytool"
homepage = "https://docs.oracle.com/en/java/javase/21/docs/specs/man/keytool.html"
description = "A key and certificate management utility that lets users administer their own public/private key pairs and associated certificates."
executables   = ["keytool"]

[dotfiles]

# keytool has no configuration file of its own: every option is a command line
# argument, and the only thing it leaves in the user's home directory is the
# keystore it manages.
paths = []

exclude = []

# The default keystore. Oracle's keytool(1) says so twice: the option value
# summary lists `-keystore <the file named .keystore in the user's home
# directory>`, and the `-keystore` description says "the default keystore file
# named .keystore is created in the user's home directory if it doesn't already
# exist".
# https://docs.oracle.com/en/java/javase/21/docs/specs/man/keytool.html
#
# OpenJDK's implementation agrees — sun/security/tools/keytool/Main.java:
#     if (ksfname == null) {
#         ksfname = System.getProperty("user.home") + File.separator + ".keystore";
#     }
# `user.home` is %USERPROFILE% on Windows, which resolves to the same `~/` this
# path already names, so there is no second Windows spelling.
#
# The file is a binary JKS/PKCS#12 keystore holding private keys. It is a
# credential end to end, and it is portable: the keystore is protected by its
# own password rather than bound to the machine that created it.
secret = ["~/.keystore"]

[commands]
format = 1
label = "keytool"
description = "List keystore entries and generate key pairs. Passwords are deliberately not fields; keytool prompts for them. Other commands are left out."
quality = "ai-draft"
base = "fig:keytool"
parser = { end_of_options = "--", interleave = "permute", long_equals = false, short_attached = false, short_bundles = false }

[[commands.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/keytool.ts"
license = "MIT"

[[commands.subcommand]]
path = ["-list"]
label = "List keystore entries"

[[commands.subcommand.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/keytool.ts"
license = "MIT"

[[commands.subcommand.field]]
id = "keystore"
label = "Keystore"
type = "path"
option = ["-keystore"]
path = { kind = "file", role = "input" }
sources = ["fig"]

[[commands.subcommand.field]]
id = "alias"
label = "Alias"
type = "string"
option = ["-alias"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "cacerts"
label = "Use cacerts"
type = "boolean"
option = ["-cacerts"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "verbose"
label = "Verbose"
type = "boolean"
option = ["-v"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "rfc"
label = "RFC style output"
type = "boolean"
option = ["-rfc"]
sources = ["fig"]

[[commands.subcommand.task]]
id = "list"
label = "List a keystore"
fields = ["keystore", "verbose"]
required = ["keystore"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["keystore", "alias", "cacerts", "verbose", "rfc"]

[[commands.subcommand]]
path = ["-genkeypair"]
label = "Generate a key pair"

[[commands.subcommand.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/keytool.ts"
license = "MIT"

[[commands.subcommand.field]]
id = "alias"
label = "Alias"
type = "string"
option = ["-alias"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "keystore"
label = "Keystore"
type = "path"
option = ["-keystore"]
path = { kind = "file", role = "output", must_exist = false }
effect = "overwrite"
sources = ["fig"]

[[commands.subcommand.field]]
id = "keyalg"
label = "Key algorithm"
type = "string"
option = ["-keyalg"]
suggestions = [{ value = "RSA", label = "RSA" }, { value = "EC", label = "EC" }]
sources = ["fig"]

[[commands.subcommand.field]]
id = "keysize"
label = "Key size (bits)"
type = "integer"
option = ["-keysize"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "validity"
label = "Validity (days)"
type = "integer"
option = ["-validity"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "dname"
label = "Distinguished name"
description = "For example CN=Example, O=Org, C=US."
type = "string"
option = ["-dname"]
sources = ["fig"]

[[commands.subcommand.task]]
id = "rsa"
label = "RSA 2048 key pair, one year"
set = { keyalg = ["RSA"], keysize = [2048], validity = [365] }
fields = ["alias", "keystore", "keyalg", "keysize", "validity", "dname"]
required = ["alias", "keystore"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["alias", "keystore", "keyalg", "keysize", "validity", "dname"]