ux: distinguish public key vs private key in CLI

[ahmetb]

Right now -key flag is used in both meanings "public key" and "private key".

It might be wise to distinguish these as -key and -pub earlier than later. Please vote 👍🏼 👎🏼 .

USAGE
  cosign verify -key <key> <image uri>

FLAGS
  -a ...              extra key=value pairs to sign
  -check-claims true  whether to check the claims found
  -key ...            path to the public key
  -kms ...            verify via a public key stored in a KMS

USAGE
  cosign sign -key <key> [-payload <path>] [-a key=value] [-upload=true|false] [-force-tlog=true|false] <image uri>

FLAGS
  -a ...             extra key=value pairs to sign
  -force-tlog false  whether to upload to the tlog even when the image is private
  -key ...           path to the private key
  -kms ...           sign via a private key stored in a KMS
  -payload ...       path to a payload file to use rather than generating one.
  -upload true       whether to upload the signature

[FalcoSuessgott]

Hi @ahmetb I would like to provide a PR for this one if u dont mind:)

What do u think about switching to cobra for the cli arg parsing?

[ahmetb]

I was planning to implement this to get used to the repo, but I’m also noticing a need for using cobra more broadly in other issues as well.

[FalcoSuessgott]

Alright I will keep looking then for a chance to contribute

[dlorenc]

+1 to someone doing this one! I don't love cobra but could be convinced to switch as long as we don't also bring in viper.

[dlorenc]

@FalcoSuessgott are you still interested in trying this?

[FalcoSuessgott]

@dlorenc implementing that feature or migrating to cobra?

[ahmetb]

FWIW I came to terms calling both pub/priv "-key" over time. So I am not sure if this is worth fixing. -key is more friendly than -pub/-priv?

[znewman01]

FWIW I came to terms calling both pub/priv "-key" over time. So I am not sure if this is worth fixing. -key is more friendly than -pub/-priv?

+1, it's usually unambiguous from the context (e.g. cosign sign --key wants the signing==private key, cosign verify --key wants the verification==public key). Plus it'll fail if you give it the wrong one.

Closing as WONTFIX

[znewman01]

Also we have migrated to Cobra in the meantime.