README
¶
signing-cli
gitlab.com/phpboyscout/go/signing-cli provides the shareable sign and
keys Cobra command builders that sit on top
of gitlab.com/phpboyscout/go/signing.
The real signing and verification logic lives in go/signing; this module owns
only the command surface, so both go-tool-base
and the standalone sigillum CLI can attach the same commands without a
dependency cycle.
Install
This is a library — there is no binary to install. Add it as a dependency of the CLI you are building:
go get gitlab.com/phpboyscout/go/signing-cli
Then attach the command builders to your Cobra root (see below). It depends only
on go/signing and Cobra, never on go-tool-base.
Commands
| Constructor | Command | Purpose |
|---|---|---|
NewCmdSign(log) |
sign <input-file> |
Produce a detached signature over a file using a configured backend — armored OpenPGP, or prehashed minisign for release artefacts. |
NewCmdKeys(log) |
keys |
Parent group for the key-management subcommands below. |
NewCmdKeysMint(log) |
keys mint |
Wrap an existing signer (KMS or local PEM) in OpenPGP framing and emit the armored public half. |
NewCmdKeysGenerate(log) |
keys generate |
Generate a fresh keypair locally (Ed25519 or RSA) and emit both halves. |
NewCmdKeysWKD(log) |
keys wkd |
Generate a Web Key Directory tree from one or more public keys. |
NewCmdKeysMinisign(log) |
keys minisign |
Emit the minisign public key for an Ed25519 signer — the string release consumers pin. |
NewCmdKeysPublish(log) |
keys publish |
Stage a minisign public key into a keys site, with a machine-readable manifest. |
Every constructor returns a plain *cobra.Command and takes a single
signingcli.Logger argument — a minimal four-method logging interface
(Debug/Info/Warn/Error) that both a *slog.Logger and
go-tool-base's logger.Logger satisfy structurally, so callers pass their
logger directly with no adapter.
Backends
Signing backends (AWS KMS, local PEM, …) are registered in the go/signing
registry by blank-imports in the consumer's main package — this module
deliberately imports no concrete backend. The commands surface whatever
backends the host binary compiled in via signing.Names() / signing.Get().
import (
_ "gitlab.com/phpboyscout/go/signing-aws-kms" // registers "aws-kms"
_ "gitlab.com/phpboyscout/go/signing/local" // registers "local"
signingcli "gitlab.com/phpboyscout/go/signing-cli"
)
root.AddCommand(signingcli.NewCmdSign(logger))
root.AddCommand(signingcli.NewCmdKeys(logger))
Documentation
- Microsite: signing-cli.go.phpboyscout.uk — a start-from-nothing tutorial, how-to guides, architecture, the command/flag reference, and what the module does not do.
- API reference: pkg.go.dev/gitlab.com/phpboyscout/go/signing-cli.
- The signing/verification logic:
go/signing(signing.go.phpboyscout.uk).
License
MIT — see LICENSE.
Documentation
¶
Overview ¶
Package signingcli provides the shareable `sign` and `keys` Cobra commands over gitlab.com/phpboyscout/go/signing. Real signing/verification logic lives in go/signing; this module owns only the command surface so GTB and the standalone `sigillum` CLI can both attach it without a cycle.
Index ¶
- Variables
- func NewCmdKeys(log Logger) *cobra.Command
- func NewCmdKeysGenerate(log Logger) *cobra.Command
- func NewCmdKeysMinisign(log Logger) *cobra.Command
- func NewCmdKeysMint(log Logger) *cobra.Command
- func NewCmdKeysPublish(log Logger) *cobra.Command
- func NewCmdKeysWKD(log Logger) *cobra.Command
- func NewCmdSign(log Logger) *cobra.Command
- type Logger
Constants ¶
This section is empty.
Variables ¶
var ( // ErrKeyAlreadyPublished is returned when a key is already // published at the same path with different content. Published keys // are add-only: consumers pin them, so changing one under a // consumer's feet is exactly what must never happen. ErrKeyAlreadyPublished = errors.NewSentinel("signing-cli.key_already_published", "a different key is already published at this path") // ErrInvalidProject is returned when --project is not a safe path // segment. ErrInvalidProject = errors.NewSentinel("signing-cli.invalid_project", "project name must be lowercase alphanumeric with dots, dashes or underscores") // ErrInvalidStatus is returned when --status is not one of the // known lifecycle states. ErrInvalidStatus = errors.NewSentinel("signing-cli.invalid_status", "unknown status") )
var ErrKeyFileExists = errors.NewSentinel("signing-cli.key_file_exists", "output file already exists")
ErrKeyFileExists is returned when a key output file already exists and --force was not supplied. Overwriting a private key in place could silently destroy the only copy of a signing key, so the default is to refuse.
Functions ¶
func NewCmdKeys ¶
NewCmdKeys returns the top-level `keys` command group with its subcommands attached.
func NewCmdKeysGenerate ¶
NewCmdKeysGenerate returns the `keys generate` subcommand. Generates a fresh keypair entirely in-process (no shell-out, no external dependencies) and writes both halves to disk. Used during onboarding for the rotation-authority key and the tutorial / local signing key.
func NewCmdKeysMinisign ¶ added in v0.2.0
NewCmdKeysMinisign returns the `keys minisign` subcommand: emit the minisign public key for an Ed25519 signer.
This is the counterpart to `keys mint`, which emits an armored OpenPGP public key. The consumers of an artefact signature do not speak OpenPGP, so they need this form instead.
func NewCmdKeysMint ¶
NewCmdKeysMint returns the `keys mint` subcommand. Wraps an existing signer (KMS or local PEM file) in OpenPGP framing and writes the armored public half to a file.
func NewCmdKeysPublish ¶ added in v0.3.0
NewCmdKeysPublish returns the `keys publish` subcommand.
func NewCmdKeysWKD ¶
NewCmdKeysWKD returns the `keys wkd` subcommand. Reads one or more armored OpenPGP public keys and emits a Web Key Directory tree (per draft-koch-openpgp-webkey-service §3.1) ready to upload to a static host.
Spec: docs/development/specs/2026-06-09-keys-wkd-command.md in go-tool-base.
func NewCmdSign ¶
NewCmdSign returns the top-level `sign` command.
Types ¶
type Logger ¶
type Logger interface {
Debug(msg string, args ...any)
Info(msg string, args ...any)
Warn(msg string, args ...any)
Error(msg string, args ...any)
}
Logger is the minimal logging surface the commands need. Both a *slog.Logger and GTB's logger.Logger satisfy it structurally, so callers pass their logger directly — no adapter.
Source Files