signing-cli¶

The shareable sign and keys Cobra command builders for the phpboyscout signing toolchain.

import signingcli "gitlab.com/phpboyscout/go/signing-cli"

signing-cli owns only the command surface. The real signing and verification logic lives in gitlab.com/phpboyscout/go/signing (and its backend modules such as signing-aws-kms). This module wraps that logic in *cobra.Command builders so that more than one host binary can attach the same commands.

Why it exists — no dependency cycle¶

go-tool-base (GTB) and the standalone sigillum CLI both want a sign/keys command that behaves identically. Putting those builders in GTB would force sigillum — and every other consumer — to import the whole framework. Putting them in go/signing would drag Cobra into a library whose whole point is to stay tiny and framework-free.

signing-cli breaks that bind: it depends only on go/signing and Cobra, and never on GTB. Both hosts import signing-cli; neither imports the other. See Why a separate module.

The constructors¶

Every builder returns a plain *cobra.Command and takes a single signingcli.Logger — a minimal four-method logging interface that both a *slog.Logger and GTB's logger.Logger satisfy structurally, so callers pass their logger directly with no adapter.

Backends are the consumer's responsibility¶

This module imports no concrete backend. The commands surface whatever backends the host binary compiled in, discovered at runtime through the go/signing registry (signing.Names() / signing.Get()). The host activates backends with blank imports in its main package:

import (
    _ "gitlab.com/phpboyscout/go/signing-aws-kms" // registers "aws-kms"
    _ "gitlab.com/phpboyscout/go/signing/local"   // registers "local"
)

See Compile in signing backends and Backends are the consumer's responsibility.

What this module does not do¶

There is no signing-cli binary — it is a library of command builders, and you get the commands by attaching them to a CLI of your own. It ships no signing backend, verifies nothing, reads no config file, and cannot sign OpenPGP with an Ed25519 key or minisign with an RSA key. The full list, with the messages you get when you cross one of those lines, is in What signing-cli does not do.

Who consumes it¶

• go-tool-base — attaches the commands to the gtb root via setup.Wrap, so scaffolded tools inherit gtb sign / gtb keys.
• sigillum — the standalone signing CLI, which attaches the same builders to a plain Cobra root.

Both paths are shown in Attach the commands to a CLI.

Where to go next¶

The documentation follows the Diátaxis framework:

• Tutorial — start here if you have not used these commands before:
  • Add signing to your CLI and sign your first release
• How-to guides — task-oriented recipes:
  • Attach the commands to a CLI
  • Compile in signing backends
• Explanation — understanding-oriented background:
  • Why a separate module
  • The Logger seam
  • Backends are the consumer's responsibility
• Reference — the command surface, flag by flag, and what happens when a value is wrong:
  • sign
  • keys (mint, generate, wkd, minisign, publish)
  • What signing-cli does not do
  • Configuration and environment
  • Errors and what they mean
• API — the exported Go symbols, with signatures and doc comments, live on pkg.go.dev. The signing/verification API is documented under go/signing.

Further reading¶

The blog carries a curated route through this subject: Signing your releases collects everything written about it, ordered so you can start at the beginning rather than newest-first.