Signing command options

You can use various command-line options to control how rh-sigstore-a2a signs Agent Cards.

The following table describes the signing command options:

Table 1. Signing options
Option Description

--output

Specifies the output path for the signed Agent Card file.

--use_ambient_credentials

Uses ambient OIDC credentials from CI/CD environments (GitHub Actions, GitLab CI) instead of interactive OAuth.

--identity_token

Provides a pre-obtained OIDC token for signing.

--client_id

Specifies the OIDC client ID when using a custom identity provider.

--provenance

Embeds SLSA build provenance metadata in the signed card.

--repository

Specifies the source repository for provenance (e.g., myorg/myrepo).

--commit_sha

Specifies the commit SHA for provenance.

--workflow_ref

Specifies the workflow reference for provenance.

--staging

Uses Sigstore’s staging infrastructure for testing.

--instance

Specifies a private Sigstore instance URL (mutually exclusive with --staging and --trust_config).

--trust_config

Provides a ClientTrustConfig JSON file path (mutually exclusive with --staging and --instance).