mirror of
https://github.com/docker/docs.git
synced 2026-11-04 10:01:00 +00:00
David Karlsson
c64e3927ef
## Summary Update the Sandbox documentation for the v0.48.0 CLI refactor: renamed flags, settings commands, terminal output, structured output, and non-interactive confirmations. Add a migration reference for scripts and CI workflows, with a [**Copy as prompt** button](https://deploy-preview-26314--docsdocker.netlify.app/ai/sandboxes/workflows/automation/#update-scripts-for-v0480) that copies agent instructions and the section Markdown. This PR targets `main` independently of the other PRs in the sbx/v0.48.0 milestone. It keeps the generated reference import separate from documentation edits: - Vendor the 120 generated CLI YAML files - Update command examples and guidance. Historical release notes retain their original command spellings. The other milestone PRs cover separate release features; this PR covers the CLI migration. @netlify /ai/sandboxes/workflows/automation/ Generated by Codex
63 lines
2.5 KiB
YAML
63 lines
2.5 KiB
YAML
name: sbx kit provenance
|
|
synopsis: Show the SLSA provenance attached to a kit
|
|
experimental: true
|
|
description: |-
|
|
Print the SLSA provenance attestation attached to an OCI kit.
|
|
|
|
Provenance is attached by `sbx kit push` as an OCI referrer of the kit
|
|
manifest. It records the kit's content digests, the sandbox image its spec
|
|
declares, and the source git commit the kit was pushed from.
|
|
|
|
Provenance pushed without --sign is unsigned: it is printed but marked
|
|
UNSIGNED, because anyone with push access to the repository could have
|
|
written it. To verify a signed attestation, pass --key for a key-based
|
|
signature, or --certificate-identity (or --certificate-identity-regexp)
|
|
together with --certificate-oidc-issuer (or its regexp form) for a keyless
|
|
one; only attestations that verify and whose subject matches the kit's own
|
|
digest are reported as VERIFIED.
|
|
usage: sbx kit provenance REFERENCE [flags]
|
|
options:
|
|
- name: certificate-identity
|
|
usage: Exact keyless signer identity (certificate SAN)
|
|
- name: certificate-identity-regexp
|
|
usage: Keyless signer identity regexp (certificate SAN)
|
|
- name: certificate-oidc-issuer
|
|
usage: Exact keyless OIDC issuer
|
|
- name: certificate-oidc-issuer-regexp
|
|
usage: Keyless OIDC issuer regexp
|
|
- name: format
|
|
usage: 'Output format: table, json or yaml'
|
|
- name: help
|
|
shorthand: h
|
|
default_value: "false"
|
|
usage: help for provenance
|
|
- name: insecure-ignore-tlog
|
|
default_value: "false"
|
|
usage: |
|
|
Do not require a Rekor transparency-log entry (for private keyless signatures)
|
|
- name: json
|
|
default_value: "false"
|
|
usage: Output in JSON format
|
|
- name: key
|
|
usage: Public key for key-based verification (PEM)
|
|
inherited_options:
|
|
- name: cloud
|
|
default_value: "false"
|
|
usage: |
|
|
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
|
|
- name: debug
|
|
shorthand: D
|
|
default_value: "false"
|
|
usage: Enable debug logging
|
|
example: |4-
|
|
# Show provenance (unsigned attestations are printed as-is)
|
|
sbx kit provenance ghcr.io/org/my-kit:1.0
|
|
|
|
# Verify a signed attestation before printing it
|
|
sbx kit provenance \
|
|
--certificate-identity user@example.com \
|
|
--certificate-oidc-issuer https://accounts.google.com \
|
|
ghcr.io/org/my-kit:1.0
|
|
see_also:
|
|
- sbx kit - (Experimental) Manage kit artifacts
|