Enum ArtifactSubcommand 

pub enum ArtifactSubcommand {
    Sign {

        file: PathBuf,
        sig_output: Option<PathBuf>,
        force: bool,
        key: Option<String>,
        device_key: Option<String>,
        expires_in: Option<u64>,
        note: Option<String>,
        commit: Option<String>,
        no_commit: bool,
        ci: bool,
        curve: Option<CurveType>,
        ci_platform: Option<String>,
        oidc_token: Option<PathBuf>,
        oidc_audience: Option<String>,
        oidc_issuer: String,
        oidc_jwks: Option<PathBuf>,
        log: Option<String>,
        allow_unlogged: bool,
    
},
    Publish {
        file: Option<PathBuf>,
        signature: Option<PathBuf>,
        package: Option<String>,
        registry: Option<String>,
        key: Option<String>,
        device_key: Option<String>,
        expires_in: Option<u64>,
        note: Option<String>,
        commit: Option<String>,
        no_commit: bool,
    },
    Verify {

        file: PathBuf,
        signature: Option<PathBuf>,
        identity_bundle: Option<PathBuf>,
        witness_receipts: Option<PathBuf>,
        witness_keys: Vec<String>,
        witness_threshold: usize,
        verify_commit: bool,
        signature_only: bool,
        offline: bool,
        roots: Option<PathBuf>,
        member: Option<String>,
        signed_at: Option<u128>,
        json: bool,
        oidc_policy: Option<PathBuf>,
        oidc_policy_did: Option<String>,
        log_evidence: Option<PathBuf>,
        log_key: Option<String>,
        expect_signer: Option<String>,
        require_rooted_signer: bool,
    
},
}

Variants

Sign

Sign an artifact file with your Auths identity.

Fields

file: PathBuf

Path to the artifact file to sign.

sig_output: Option<PathBuf>

Output path for the signature file. Defaults to .auths.json.

force: bool

Overwrite the –sig-output file if it already exists.

key: Option<String>

Local alias of the identity key (used for signing). Omit for CI device-only signing.

device_key: Option<String>

Local alias of the device key (used for dual-signing). Auto-detected when only one key exists for the identity.

expires_in: Option<u64>

Duration in seconds until expiration (per RFC 6749).

note: Option<String>

Optional note to embed in the attestation.

commit: Option<String>

Git commit SHA to embed in the attestation (provenance binding; embedded only when given, never inferred from git state).

no_commit: bool

Do not embed any commit SHA in the attestation.

ci: bool

Use ephemeral CI signing (no keychain needed). Requires –commit.

curve: Option<CurveType>

Curve for the ephemeral CI key (p256 or ed25519). Only meaningful with –ci; defaults to p256.

ci_platform: Option<String>

CI platform override when –ci is used outside a detected CI environment.

oidc_token: Option<PathBuf>

Path to the runner’s OIDC token (the keyless exchange: the token is validated against the issuer’s JWKS and the verified claims are embedded in the signed attestation as an OIDC binding).

oidc_audience: Option<String>

Expected OIDC token audience (exact match). Required with –oidc-token.

oidc_issuer: String

Expected OIDC token issuer (exact match).

oidc_jwks: Option<PathBuf>

Pinned JWKS file for offline/air-gapped token validation (default: fetch the issuer’s published JWKS over HTTPS).

log: Option<String>

Transparency log to submit to (overrides default from trust config).

allow_unlogged: bool

Skip transparency log submission (local testing only). Produces an unlogged attestation that verifiers reject by default.

Publish

Sign and publish an artifact attestation to a registry.

Auto-signs the artifact when no –signature is provided.

Fields

file: Option<PathBuf>

Artifact file to sign and publish (auto-signs if no –signature).

signature: Option<PathBuf>

Path to an existing .auths.json signature file. Defaults to .auths.json.

package: Option<String>

Package identifier for registry indexing (e.g., npm:react@18.3.0).

registry: Option<String>

Registry URL to publish to.

key: Option<String>

Local alias of the identity key. Omit for device-only CI signing.

device_key: Option<String>

Local alias of the device key. Auto-detected when only one key exists.

expires_in: Option<u64>

Duration in seconds until expiration.

note: Option<String>

Optional note to embed in the attestation.

commit: Option<String>

Git commit SHA to embed in the attestation (provenance binding; embedded only when given, never inferred from git state).

no_commit: bool

Do not embed any commit SHA in the attestation.

Verify

Verify an artifact’s signature against an Auths identity.

Fields

file: PathBuf

Path to the artifact file to verify.

signature: Option<PathBuf>

Path to the signature file. Defaults to .auths.json.

identity_bundle: Option<PathBuf>

Path to identity bundle JSON (for CI/CD stateless verification).

witness_receipts: Option<PathBuf>

Path to witness signatures JSON file.

witness_keys: Vec<String>

Witness public keys as DID:hex pairs (e.g., “did:key:z6Mk…:abcd1234…”).

witness_threshold: usize

Number of witnesses required (default: 1).

verify_commit: bool

Also verify the source commit’s signing attestation.

signature_only: bool

For an ephemeral (did:key:) attestation, confirm the signature over the artifact digest WITHOUT chasing the commit-anchor leg. This is the runner’s self-check: it has no maintainer repo/roots, but it can prove it signed what it emitted. A pass means “digest matches, ephemeral key signed it”, not “the signer trust-chains to a maintainer”.

offline: bool

Verify an air-gapped org bundle entirely offline (no network access).

roots: Option<PathBuf>

Override the pinned trust roots path (default: .auths/roots).

member: Option<String>

(offline) Member did:keri to classify authority for.

signed_at: Option<u128>

(offline) The artifact’s in-band signing KEL position.

json: bool

(offline) Emit the typed verdict as JSON.

oidc_policy: Option<PathBuf>

OIDC-subject policy file to JOIN against the attestation’s signed OIDC binding (issuer + repository [+ workflow_ref] the org trusts). Fail-closed: a missing binding or any mismatch fails verification.

oidc_policy_did: Option<String>

Resolve the OIDC-subject policy from the org’s KEL instead of a pinned file: reads the latest policy digest the org anchored (auths org anchor-oidc-policy) from the local registry and refuses a digest mismatch — the witnessed log is the source of truth.

log_evidence: Option<PathBuf>

Offline transparency-log inclusion evidence for this artifact (auths log prove --out). Verified fully offline; the verdict’s anchored field reports the outcome. Requires –log-key — an inclusion proof without a pinned operator proves nothing.

log_key: Option<String>

The log operator’s Ed25519 public key (64 hex chars), pinned out of band — never trusted from the evidence file itself.

expect_signer: Option<String>

Require the verified signer to be exactly this identity (e.g. a release signer). Fails closed on a signer mismatch — an allowlist applied after verification, it can only narrow a valid verdict, never widen it.

require_rooted_signer: bool

Require the verified signer to be a rooted did:keri identity (a rotatable, revocable key-state log), rejecting a bare did:key self-attestation. Fails closed; applied after verification, it can only narrow a valid verdict, never widen it.

Trait Implementations

impl Clone for ArtifactSubcommand

fn clone(&self) -> ArtifactSubcommand

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ArtifactSubcommand

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl FromArgMatches for ArtifactSubcommand

fn from_arg_matches(__clap_arg_matches: &ArgMatches) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn from_arg_matches_mut( __clap_arg_matches: &mut ArgMatches, ) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn update_from_arg_matches( &mut self, __clap_arg_matches: &ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

fn update_from_arg_matches_mut<'b>( &mut self, __clap_arg_matches: &mut ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

impl Subcommand for ArtifactSubcommand

fn augment_subcommands<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate Self via FromArgMatches::from_arg_matches_mut

fn augment_subcommands_for_update<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate self via FromArgMatches::update_from_arg_matches_mut

fn has_subcommand(__clap_name: &str) -> bool

Test whether Self can parse a specific subcommand