Create Evidence CLI

--predicate

file-path

required

string

Defines the path to a locally-stored, arbitrary JSON file that contains the predicate (the content of the evidence).

--predicate-type

predicate-type-uri

required

string

The type of predicate defined by the JSON file. Sample predicate type URIs:

https://in-toto.io/attestation/link/v0.3
https://in-toto.io/attestation/scai/attribute-report
https://in-toto.io/attestation/runtime-trace/v0.1
https://in-toto.io/attestation/test-result/v0.1
https://in-toto.io/attestation/vulns

--key

local-private-key-path

optional

string

Path to a private key (see Tip below). Supported key types: 'rsa', 'ed25519', 'ecdsa'

Supported key formats: PEM and SSH

--key-alias

RSA-1024

optional

string

Case-sensitive name for the public key created from the private key (see Tip below). The public key is used to verify the DSSE envelope that contains the evidence.

• If the key-alias is included, DSSE verification will fail if the same key-name is not found in Artifactory.

• If the key-alias is not included, DSSE verification with the public key is not performed during creation.

--markdown

md-file

optional

string

Path to a file that contains evidence in Markdown format.

--project

project-name

optional

string

Name of the project associated with the evidence subject. This argument can be used with build, package, and Release Bundle evidence.

--provider-id

optional

string

Name of the provider that created the evidence.

--sigstore-bundle

optional

string

Path to a Sigstore bundle file containing a pre-signed DSSE envelope. If the evidence subject is not provided (using --subject-repo-path), Artifactory attempts to resolve the subject automatically from the DSSE envelope. Any subject resolution errors have exit code 2.

--sigstore-bundle is incompatible with --key,--key-alias,--predicate,--predicate-type, and --subject-sha256.

--integration

optional

string

Indicates an attestation created by a 3rd-party tool that can be converted by the JFrog platform into evidence.

Available values:

• sonar: When enabled, the Evidence service automatically generates the predicate from SonarQube analysis data. Requires the SONAR_TOKENor SONARQUBE_TOKEN environment variable to fetch the data from the SonarQube server. For more information, see Sonar Evidence Integration.

--attach-local

file-name

optional

string

Name of a local file to attach to the evidence.

attach-artifactory-temp-path

file-path

optional

string

Defines the path to a locally-stored file that will be attached to the evidence. This value is persisted until it is next changed.

JFROG_CLI_SIGNING_KEY

--key

If the environment variable is not defined, the --key command is mandatory.

JFROG_CLI_KEY_ALIAS

--key-alias

EVIDENCE_ATTACHMENT_ARTIFACTORY_TEMP_PATH

--attach-artifactory-temp-path

A third option is to add the following configuration to the Evidence YAML file:

attachment: artifactoryTempPath: <repo/path-in-artifactory>

--subject-repo-path

required for artifact evidence

The target path of the artifact. Each evidence file must contain a single subject and include the path.

Artifacts located in local repositories aggregated inside virtual repositories are supported (evidence is added to the local path).

--subject-sha256

optional

Optional digest (sha256) of the artifact.

• If a digest is provided, it is verified against the subject's sha256 as it appears in Artifactory.

• If a digest is not provided, the sha256 is taken from the path in Artifactory.