packslip create
- Usage:
packslip create [FLAGS] [ARTIFACTS]…
Create and sign a packslip for a release
Hash local artifacts, infer platforms and formats from filenames, and write a signed bundle to –out. Use –manifest for per-artifact paths, formats, requirements, and scoped resources. No files are uploaded.
Signing uses a supported CI OIDC identity by default. Use –key to sign with an Ed25519 key instead. Signatures are logged to Rekor unless a key-signed release explicitly uses –no-log.
Examples and configuration: https://packslip.dev/docs/describing-releases/
Arguments
[ARTIFACTS]…— Artifact files, optionally as path[:os/arch[/libc]|:any][@variant]. Added to those the manifest lists
Flags
--project <PROJECT>— The project’s name: a host path such as github.com/owner/repo, or github.com/owner/repo/tool for one tool of a monorepo. Required unless the manifest names it--version <VERSION>— Semver release version, such as 1.2.3. Required unless set in the manifest-m --manifest <MANIFEST>— A TOML manifest giving per-artifact executables, formats, requirements, platforms, and the release’s resources; see https://packslip.dev/docs/describing-releases/-k --key <KEY>— Sign with this secret key instead of a CI identity--sign <SIGN>— How to sign; defaults to key when –key is given, else oidc--no-log— With –key: do not record the signature in Rekor. Consumers must then opt in with –allow-unlogged-o --out <OUT>— Directory for the signed bundle (does not copy artifacts)Default:
.--url-base <URL_BASE>— Download URL prefix for the artifacts--url <URL>— Download URL for one artifact or resource asset, as FILENAME=URL (repeatable)--format <FORMAT>— Format of one artifact whose name does not say, as FILENAME=FORMAT: an archive (tar.xz, tar.gz, tar.zst, tar.bz2, tgz, tar, zip, 7z), a single compressed executable (gz, xz, zst, bz2), an installer (deb, rpm, dmg, pkg, msi, msix, exe, appimage), raw for a bare executable, or a type of your own (repeatable)--source-repo <SOURCE_REPO>— Source repository URL--commit <COMMIT>— Source commit--tag <TAG>— Source tag--published-at <PUBLISHED_AT>— RFC 3339 publish time; defaults to now--notes-url <NOTES_URL>— URL of the release notes--extension <EXTENSION>— Release-level extension as NAME=JSON, where NAME is who defines it (a consumer such as mise, or a domain the vendor controls) and JSON is its value. Example: ’example.com={“build_id”:“20260901.3”}’ (repeatable)--bin <BIN>— Executable inside every artifact, as PATH or NAME=PATH; for a bare executable, the name it gets on PATH (repeatable)--resource <RESOURCE>— Something else the release ships, as KIND[/QUALIFIER][@os[/arch[/libc]]]=SOURCE:VALUE where SOURCE is archive (a path inside every archive), asset (a separate release file, by local path), repo (a path at –commit), or exec (a command whose stdout is the file). Kinds: completion/SHELL (or completion/SHELL,SHELL with exec and a {shell} placeholder), man[/BIN], cli-spec/FORMAT[/BIN], skill/NAME, sbom/FORMAT, desktop, icon, app. An @ scope limits the entry to the artifacts of that platform, for a layout that differs across them; the manifest also scopes to one exact artifact. Examples: ‘completion/zsh=archive:share/zsh/site-functions/_tool’, ‘man@linux=archive:share/man/man1/tool.1’ (repeatable)--provenance <PROVENANCE>— Provenance URL for an artifact, as FILENAME=URL, or bare URLs in the order the artifacts are given (repeatable)--attested-by <ATTESTED_BY>— Who makes the claim: vendor (default) or repackager--evidence <EVIDENCE>— What a repackager checked, as KIND or KIND=DETAIL (repeatable)--no-sha512— Record only sha256, not sha512 as well--require <REQUIRE>— A command the executables need on PATH, as bin:NAME or bin:NAME@MIN where MIN is the lowest version that works. Example: bin:java@17 (repeatable)--no-libs— Do not open the artifacts to record the shared libraries their executables load from the host-h --help— Print help