id = "minisign"
name = "Minisign"
homepage = "https://jedisct1.github.io/minisign/"
description = "A dead simple tool to sign files and verify signatures."
executables = ["minisign"]

[dotfiles]

# https://github.com/jedisct1/minisign/blob/master/README.md documents the
# default encrypted secret key location as ~/.minisign/minisign.key. Public
# keys and signatures default to the working directory, not a stable home path.
paths = []
exclude = []
secret = ["~/.minisign/minisign.key"]
side_effect = false

[commands]
format = 1
label = "Sign or verify a file"
description = "Sign a file with a secret key or verify a signature against a public key. Key generation, recreating or re-encrypting keys and legacy-format signing are left out."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = false, short_attached = false, short_bundles = false }

[[commands.source]]
id = "help"
kind = "help"
url = "https://github.com/jedisct1/minisign/blob/master/src/minisign.c"
revision = "master 2026-10"
evidence = """minisign -S [-l] [-x sig_file] [-s seckey_file] [-c untrusted_comment]
            [-t trusted_comment] -m file [file ...]
minisign -V [-H] [-x sig_file] [-p pubkey_file | -P pubkey] [-o] [-q] -m file
-S                sign files
-V                verify that a signature is valid for a given file
-m <file>         file to sign/verify
-o                combined with -V, output the file content after verification
-p <pubkey_file>  public key file (default: ./minisign.pub)
-P <pubkey>       public key, as a base64 string
-s <seckey_file>  secret key file (default: ~/.minisign/minisign.key)
-W                do not encrypt/decrypt the secret key with a password
-x <sigfile>      signature file (default: <file>.minisig)
-c <comment>      add a one-line untrusted comment
-t <comment>      add a one-line trusted comment
-q                quiet mode, suppress output"""

[[commands.field]]
id = "sign"
label = "Sign"
type = "boolean"
option = ["-S"]
sources = ["help"]

[[commands.field]]
id = "verify"
label = "Verify"
type = "boolean"
option = ["-V"]
sources = ["help"]

[[commands.field]]
id = "file"
label = "File"
type = "path"
path = { kind = "file", role = "input" }
option = ["-m"]
sources = ["help"]

[[commands.field]]
id = "seckey"
label = "Secret key file"
description = "Defaults to ~/.minisign/minisign.key."
type = "path"
path = { kind = "file", role = "input" }
option = ["-s"]
sources = ["help"]

[[commands.field]]
id = "pubkey_file"
label = "Public key file"
description = "Defaults to ./minisign.pub."
type = "path"
path = { kind = "file", role = "input" }
option = ["-p"]
sources = ["help"]

[[commands.field]]
id = "pubkey"
label = "Public key (base64)"
type = "string"
option = ["-P"]
sources = ["help"]

[[commands.field]]
id = "sigfile"
label = "Signature file"
description = "Defaults to <file>.minisig."
type = "path"
path = { kind = "file", role = "input" }
option = ["-x"]
sources = ["help"]

[[commands.field]]
id = "trusted_comment"
label = "Trusted comment"
type = "string"
option = ["-t"]
sources = ["help"]

[[commands.field]]
id = "untrusted_comment"
label = "Untrusted comment"
type = "string"
option = ["-c"]
sources = ["help"]

[[commands.field]]
id = "no_password"
label = "Unencrypted secret key"
description = "Do not encrypt/decrypt the secret key with a password."
type = "boolean"
option = ["-W"]
sources = ["help"]

[[commands.field]]
id = "quiet"
label = "Quiet"
type = "boolean"
option = ["-q"]
sources = ["help"]

[[commands.task]]
id = "sign"
label = "Sign a file"
fields = ["sign", "file", "seckey", "trusted_comment", "untrusted_comment", "sigfile", "no_password"]
required = ["sign", "file"]
set = { sign = [true] }

[[commands.task]]
id = "verify"
label = "Verify a signature"
fields = ["verify", "file", "pubkey_file", "pubkey", "sigfile", "quiet"]
required = ["verify", "file"]
set = { verify = [true] }

[[commands.group]]
id = "basic"
label = "Basic"
fields = ["sign", "verify", "file", "seckey", "pubkey_file", "pubkey"]

[[commands.group]]
id = "advanced"
label = "Advanced"
fields = ["sigfile", "trusted_comment", "untrusted_comment", "no_password", "quiet"]