CLI reference

This reference follows continuum-attest/src/main.rs at version 0.1.0. Use attest --help and attest <command> --help for the exact options of the binary installed on your machine. Global options are --verbose and --quiet.

Command	Purpose
`attest init`	Create the local workspace and a starter pipeline
`attest run`	Execute a pipeline or wrap one command
`attest keys`	Generate, list, export, import or revoke keys
`attest hash`	Compute canonical hashes of declared paths
`attest capsule`	Initialize, run or hash an execution capsule
`attest verify`	Check receipts or an offline archive
`attest export`	Export a receipt as an in-toto DSSE envelope
`attest import`	Verify an imported in-toto DSSE envelope
`attest image`	Image signing and verification operations
`attest causal`	Causal ledger operations

Run a pipeline

attest run --pipeline attest.yaml --sign
attest run --sign --key <key-id>
attest run --check-reproducibility

--verify selects isolated execution for a pipeline; it does not replace attest verify on the resulting receipt. --check-reproducibility runs the pipeline twice in fresh workspaces and compares output hashes. Use the configuration reference for step fields.

Wrap one command

attest run --wrap --name build --input src/ --output dist/ -- npm run build

Repeat --input and --output for multiple paths. --workspace DIR chooses the root. Wrap mode runs without a pipeline file or sandbox; signing can be added with --sign and a provisioned key. See CI integration.

Verify receipts

attest verify .attest/receipts/<receipt>.yaml
attest verify --recompute .attest/receipts/<receipt>.yaml
attest verify --trust-store /path/to/trust --format json receipt.yaml
attest verify --archive bundle.attest.tar.zst --offline

Exit codes are 0 for success, 1 for a failed verification and 2 for an operational error. JSON output is NDJSON. Signature checking defaults to true; --check-signatures false explicitly allows checks of an unsigned receipt and does not establish signer trust. See Receipts and trust.

Keys and hashes

attest keys generate --name ci
attest keys list
attest keys export <key-id> --output ci.pub
attest keys import ci.pub --name team-ci
attest keys revoke <key-id>
attest hash --input src/ --run 'npm run build'
attest hash --output dist/

Key export contains public material only. See key management for CI provisioning and rotation.

Standard-format exchange

attest export --receipt receipt.yaml --format in-toto --output statement.json
attest import statement.json --format in-toto --report json

Export signs the envelope using an available key; --key selects it. --allow-unsigned explicitly permits unsigned export. Import verifies an envelope against the trust store; it is not an upload to the SaaS.

Additional command groups

attest capsule --help
attest image --help
attest causal --help

Capsule initialization requires a digest-pinned OCI reference rather than a tag and capsule execution needs a container runtime. Review these paths in your environment before adopting them. The developer guide identifies their source and tests.

Commands such as attest login, attest publish, attest deploy, attest status and attest cache are not exposed by the current binary.