Skip to content

signing-cli

The shareable sign and keys Cobra command builders for the phpboyscout signing toolchain.

import signingcli "gitlab.com/phpboyscout/go/signing-cli"

signing-cli owns only the command surface. The real signing and verification logic lives in gitlab.com/phpboyscout/go/signing (and its backend modules such as signing-aws-kms). This module wraps that logic in *cobra.Command builders so that more than one host binary can attach the same commands.

Why it exists — no dependency cycle

go-tool-base (GTB) and the standalone sigillum CLI both want a sign/keys command that behaves identically. Putting those builders in GTB would force sigillum — and every other consumer — to import the whole framework. Putting them in go/signing would drag Cobra into a library whose whole point is to stay tiny and framework-free.

signing-cli breaks that bind: it depends only on go/signing and Cobra, and never on GTB. Both hosts import signing-cli; neither imports the other. See Why a separate module.

The constructors

Every builder returns a plain *cobra.Command and takes a single signingcli.Logger — a minimal four-method logging interface that both a *slog.Logger and GTB's logger.Logger satisfy structurally, so callers pass their logger directly with no adapter.

Constructor Command Purpose
NewCmdSign(log) sign <input-file> Produce an ASCII-armored OpenPGP detached signature over a file using a configured backend.
NewCmdKeys(log) keys Parent group with mint, generate, and wkd attached.
NewCmdKeysMint(log) keys mint Wrap an existing signer (KMS or local PEM) in OpenPGP framing and emit the armored public half.
NewCmdKeysGenerate(log) keys generate Generate a fresh keypair locally (Ed25519 or RSA) and emit both halves.
NewCmdKeysWKD(log) keys wkd Generate a Web Key Directory tree from one or more public keys.

Backends are the consumer's responsibility

This module imports no concrete backend. The commands surface whatever backends the host binary compiled in, discovered at runtime through the go/signing registry (signing.Names() / signing.Get()). The host activates backends with blank imports in its main package:

import (
    _ "gitlab.com/phpboyscout/go/signing-aws-kms" // registers "aws-kms"
    _ "gitlab.com/phpboyscout/go/signing/local"   // registers "local"
)

See Compile in signing backends and Backends are the consumer's responsibility.

Who consumes it

  • go-tool-base — attaches the commands to the gtb root via setup.Wrap, so scaffolded tools inherit gtb sign / gtb keys.
  • sigillum — the standalone signing CLI, which attaches the same builders to a plain Cobra root.

Both paths are shown in Attach the commands to a CLI.

Where to go next

The documentation follows the Diátaxis framework: