mirror of
https://github.com/docker/docs.git
synced 2026-10-25 06:09:46 +03:00
58 lines
2.3 KiB
YAML
58 lines
2.3 KiB
YAML
name: sbx kit push
|
|
synopsis: Push a kit artifact to an OCI registry
|
|
experimental: true
|
|
description: |-
|
|
Package and push a kit artifact directory to an OCI registry.
|
|
|
|
The directory must contain a valid spec.yaml. The reference should be
|
|
in the format "registry/repo:tag" (e.g., "ghcr.io/myorg/my-plugin:1.0").
|
|
|
|
The OCI artifact format is selected from the kit's spec.yaml:
|
|
schemaVersion: "1" → legacy ZIP-based artifact
|
|
schemaVersion: "2" → v2 tar+gzip layer with the spec in the manifest
|
|
config blob and standard OCI annotations (so
|
|
distribution tooling can read kit metadata
|
|
without pulling layers)
|
|
|
|
With --sign, the pushed manifest is signed and the Sigstore bundle is
|
|
attached to the kit as an OCI referrer. Signing is keyless (Fulcio +
|
|
Rekor) unless --key is given for key-based signing.
|
|
|
|
Every push also attaches a SLSA provenance attestation as an OCI
|
|
referrer, recording the kit's content digests, the declared sandbox
|
|
image, and the source git commit when the directory is a working tree.
|
|
The provenance is unsigned unless --sign is given, in which case it is
|
|
signed as a DSSE in-toto attestation with the same identity or key.
|
|
|
|
Authentication uses the Docker credential store.
|
|
usage: sbx kit push DIRECTORY REFERENCE [flags]
|
|
options:
|
|
- name: help
|
|
shorthand: h
|
|
default_value: "false"
|
|
usage: help for push
|
|
- name: identity-token
|
|
usage: |
|
|
OIDC identity token for keyless signing; defaults to the ambient CI provider, then an interactive browser login
|
|
- name: identity-token-file
|
|
usage: |
|
|
File holding the OIDC identity token; keeps it out of the process arguments
|
|
- name: key
|
|
usage: |
|
|
Private key for key-based signing (PEM); omit for keyless signing
|
|
- name: sign
|
|
default_value: "false"
|
|
usage: |
|
|
Sign the pushed kit and attach the signature as an OCI referrer
|
|
- name: tlog-upload
|
|
default_value: "true"
|
|
usage: |
|
|
Upload the keyless signature to the Rekor transparency log; set false for private kits
|
|
inherited_options:
|
|
- name: debug
|
|
shorthand: D
|
|
default_value: "false"
|
|
usage: Enable debug logging
|
|
see_also:
|
|
- sbx kit - (Experimental) Manage kit artifacts
|