id = "rekor-cli"
name = "Rekor CLI"
homepage = "https://github.com/sigstore/rekor"
description = "Command-line client for the Rekor transparency log."
executables = ["rekor-cli"]

[dotfiles]

# The official rekor-cli man page documents $HOME/.rekor.yaml as the default
# for its --config option.
# https://manpages.debian.org/unstable/rekor/rekor-cli.1.en.html
paths = ["~/.rekor.yaml"]
secret = []

[commands]
format = 1
label = "Query the Rekor transparency log"
description = "Look up entries in a Rekor log with search or get. Upload and verify, tree-state options and the format option are not covered."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = false, short_bundles = false }

[[commands.source]]
id = "man"
kind = "manual"
url = "https://manpages.debian.org/unstable/rekor/rekor-cli.1.en.html"
revision = "1.5.3-2"
evidence = '''
--rekor_server url  Server address:port (default https://rekor.sigstore.dev)
--timeout format   HTTP timeout (default 30s)
--retry uint       Number of times to retry HTTP requests (default 3)
--format format    Command output format (default default)
'''

[[commands.field]]
id = "server"
label = "Rekor server"
type = "url"
option = ["--rekor_server"]
sources = ["man"]

[[commands.field]]
id = "timeout"
label = "HTTP timeout"
type = "string"
option = ["--timeout"]
suggestions = [{ value = "30s", label = "30s" }, { value = "2m", label = "2m" }]
sources = ["man"]

[[commands.group]]
id = "basic"
label = "Basic"
fields = ["server", "timeout"]

[[commands.subcommand]]
path = ["search"]
label = "Search entries"
description = "Find entries by artifact, hash, key or email. Give at least one of them."

[[commands.subcommand.source]]
id = "src"
kind = "help"
url = "https://github.com/sigstore/rekor/blob/main/cmd/rekor-cli/app/search.go"
revision = "main 2026-10-27"
evidence = '''
--pki-format  format of the signature and/or public key
--public-key  path or URL to public key file
--artifact  path or URL to artifact file
--sha  the SHA512, SHA256 or SHA1 sum of the artifact
--email  email associated with the public key's subject
--operator  operator to use for the search. supported values are 'and' and 'or'
'''
[[commands.subcommand.source]]
id = "root"
kind = "manual"
url = "https://manpages.debian.org/unstable/rekor/rekor-cli.1.en.html"
revision = "1.5.3-2"
evidence = '''
--rekor_server url  Server address:port (default https://rekor.sigstore.dev)
--timeout format   HTTP timeout (default 30s)
--retry uint       Number of times to retry HTTP requests (default 3)
--format format    Command output format (default default)
'''

[[commands.subcommand.field]]
id = "server"
label = "Rekor server"
type = "url"
option = ["--rekor_server"]
sources = ["root"]

[[commands.subcommand.field]]
id = "artifact"
label = "Artifact file or URL"
type = "path"
option = ["--artifact"]
path = { kind = "file", role = "input" }
sources = ["src"]

[[commands.subcommand.field]]
id = "sha"
label = "Artifact SHA sum"
type = "string"
option = ["--sha"]
sources = ["src"]

[[commands.subcommand.field]]
id = "public_key"
label = "Public key file or URL"
type = "path"
option = ["--public-key"]
path = { kind = "file", role = "input" }
sources = ["src"]

[[commands.subcommand.field]]
id = "pki_format"
label = "Key/signature format"
type = "string"
option = ["--pki-format"]
suggestions = [{ value = "x509", label = "x509" }, { value = "minisign", label = "minisign" }, { value = "ssh", label = "ssh" }, { value = "pgp", label = "pgp" }]
sources = ["src"]

[[commands.subcommand.field]]
id = "email"
label = "Subject email"
type = "string"
option = ["--email"]
sources = ["src"]

[[commands.subcommand.field]]
id = "operator"
label = "Combine criteria with"
type = "enum"
option = ["--operator"]
choices = [{ value = "and", label = "and" }, { value = "or", label = "or" }]
sources = ["src"]

[[commands.subcommand.task]]
id = "search"
label = "Search entries"
fields = ["artifact", "sha", "public_key", "pki_format", "email", "operator"]
required = []

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["server", "artifact", "sha", "public_key", "pki_format", "email", "operator"]

[[commands.subcommand]]
path = ["get"]
label = "Get an entry"
description = "Fetch one entry by UUID or log index."

[[commands.subcommand.source]]
id = "src"
kind = "help"
url = "https://github.com/sigstore/rekor/blob/main/cmd/rekor-cli/app/get.go"
revision = "main 2026-10-27"
evidence = '''
rekor-cli get --log-index 0
return nil, errors.New("either --uuid or --log-index must be specified")
'''
[[commands.subcommand.source]]
id = "root"
kind = "manual"
url = "https://manpages.debian.org/unstable/rekor/rekor-cli.1.en.html"
revision = "1.5.3-2"
evidence = '''
--rekor_server url  Server address:port (default https://rekor.sigstore.dev)
--timeout format   HTTP timeout (default 30s)
--retry uint       Number of times to retry HTTP requests (default 3)
--format format    Command output format (default default)
'''

[[commands.subcommand.field]]
id = "server"
label = "Rekor server"
type = "url"
option = ["--rekor_server"]
sources = ["root"]

[[commands.subcommand.field]]
id = "uuid"
label = "Entry UUID"
type = "string"
option = ["--uuid"]
sources = ["src"]

[[commands.subcommand.field]]
id = "log_index"
label = "Log index"
type = "integer"
option = ["--log-index"]
sources = ["src"]

[[commands.subcommand.task]]
id = "get"
label = "Get an entry"
fields = ["uuid", "log_index"]
required = []

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["server", "uuid", "log_index"]