For complete examples, see the guides. This reference is generated from CLI help.

packslip releases

• Usage: packslip releases <FLAGS>

Create and sign a project’s release list

Read local release bundles and write a signed index with their digests, versions, expiry, and sequence. Repeat –release for every entry to keep; this command does not append to a previous list or upload the output.

Publish at the project’s well-known location, or as a supplementary list on a GitHub repository’s default branch. See https://packslip.dev/docs/release-lists/ .

Flags

• --project <PROJECT> — The project’s name, which every listed packslip must carry

• --sequence <SEQUENCE> — Increases with every list published

• --latest <LATEST> — Recommend this exact listed version for unconstrained latest requests

• --valid-for <VALID_FOR> — How long the list stays current: 30d, 12h, 2w

  Default: 30d

• --generated-at <GENERATED_AT> — RFC 3339 generation time; defaults to now

• --release <RELEASE> — A released packslip as URL=PATH: where consumers fetch it, and the local copy to read (repeatable)

• --yank <YANK> — Mark a listed release withdrawn, as URL=REASON (repeatable)

• --security <SECURITY> — Mark a listed release as a security fix, by URL (repeatable)

• --evidence <EVIDENCE> — What a publisher other than the vendor checked about a listed release, as URL=KIND or URL=KIND=DETAIL (repeatable)

• -k --key <KEY> — Sign with this secret key instead of a CI identity

• --sign <SIGN> — How to sign; defaults to key when –key is given, else oidc

• --no-log — With –key: do not record the signature in Rekor

• -o --out <OUT> — Where to write the list

  Default: packslip-releases.sigstore.json

• -h --help — Print help