[[command]]
name = "cosign"
description = "Sigstore's container image signing and verification tool. Core operations split into signing (which writes signatures to registries or transparency logs) and verification (which reads and validates them). Verification subcommands like verify and verify-attestation are read-only, fetching signatures and attestation data from registries and Rekor transparency logs. Signing, attesting, and uploading subcommands modify registry state and interact with OIDC providers for keyless signing. The triangulate subcommand is read-only (resolves the signature location for an image). The project ships roughly monthly releases and recently underwent a major version bump to v3, which changed default behaviors around bundle formats and attestation storage."
url = "https://github.com/sigstore/cosign"
bare_flags = ["--help", "--version", "-h"]

[[command.sub]]
name = "verify"
bare = false
standalone = ["--check-claims", "--help", "--local-image", "--offline", "-h"]
valued = [
    "--attachment", "--certificate", "--certificate-chain",
    "--certificate-identity", "--certificate-identity-regexp",
    "--certificate-oidc-issuer", "--certificate-oidc-issuer-regexp",
    "--k8s-keychain", "--key", "--output", "--payload",
    "--rekor-url", "--signature", "--slot",
    "-o",
]

[[command.sub]]
name = "verify-attestation"
bare = false
standalone = ["--check-claims", "--help", "--local-image", "--offline", "-h"]
valued = [
    "--certificate", "--certificate-identity", "--certificate-oidc-issuer",
    "--key", "--output", "--policy", "--rekor-url", "--type",
    "-o",
]

[[command.sub]]
name = "tree"
bare = false
standalone = ["--help", "-h"]

[[command.sub]]
name = "triangulate"
bare = false
standalone = ["--help", "-h"]
valued = ["--type"]

[[command.sub]]
name = "version"
standalone = ["--help", "-h"]
