Try JFrog
Guides
Contact SupportTry JFrog
  1. CLI
  2. Evidence Service CLI

Create Evidence CLI

Create signed evidence for artifacts, packages, builds, and more using the JFrog CLI.

Description: Use the create command to create evidence files, which are then deployed to Artifactory. You can create evidence for artifacts, packages, builds, and Release Bundles v2.

The Create Evidence command creates evidence files, which are then deployed to Artifactory. You can create evidence for:

  • Artifacts
  • Packages
  • Builds
  • Release Bundles v2
  • Application versions

Authentication

To create and deploy evidence, use an access token or the web login mechanism for authentication. Basic authentication using a username or password is not supported.

Syntax

Artifact evidence:

jf evd create --predicate <file-path> --predicate-type <predicate-type-uri> --subject-repo-path <target-path> --subject-sha256 <digest> --attach-local <file-name> --attach-artifactory-temp-path <target-path> --attach-artifactory-path <target-path> --key <local-private-key-path> --key-alias <public-key-name> --provider-id <provider-id>

Package evidence:

jf evd create --predicate <file-path> --predicate-type <predicate-type-uri> --package-name <name> --package-version <version-number> --package-repo-name <repo-name> --attach-local <file-name> --attach-artifactory-temp-path <target-path> --attach-artifactory-path <target-path> --key <local-private-key-path> --key-alias <public-key-name> --provider-id <provider-id>

Build evidence:

jf evd create --predicate <file-path> --predicate-type <predicate-type-uri> --build-name <name> --build-number <version-number> --attach-local <file-name> --attach-artifactory-temp-path <target-path> --attach-artifactory-path <target-path> --key <local-private-key-path> --key-alias <public-key-name> --provider-id <provider-id>

Release Bundle v2 evidence:

jf evd create --predicate <file-path> --predicate-type <predicate-type-uri> --release-bundle <name> --release-bundle-version <version-number> --attach-local <file-name> --attach-artifactory-temp-path <target-path> --attach-artifactory-path <target-path> --key <local-private-key-path> --key-alias <public-key-name> --provider-id <provider-id>

Application version evidence:

jf evd create --predicate <file-path> --predicate-type <predicate-type-uri> --application-key <name> --application-version <version-number> --attach-local <file-name> --attach-artifactory-temp-path <target-path> --attach-artifactory-path <target-path> --key <local-private-key-path> --key-alias <public-key-name> --provider-id <provider-id>
📘

Note

For sample commands, see Create Evidence CLI - Sample Commands.

Command Parameters

ParameterRequired/OptionalTypeDescription

--predicate

file-path

required unless --sigstore-bundle is usedstringDefines the path to a locally-stored, arbitrary JSON file that contains the predicate (the content of the evidence).

--predicate-type

predicate-type-uri

required unless --sigstore-bundle is usedstringThe type of predicate defined by the JSON file. Sample predicate type URIs:
https://in-toto.io/attestation/link/v0.3
https://in-toto.io/attestation/scai/attribute-report
https://in-toto.io/attestation/runtime-trace/v0.1
https://in-toto.io/attestation/test-result/v0.1
https://in-toto.io/attestation/vulns

--key

local-private-key-path

optionalstring

Path to a private key. Supported key types: rsa, ed25519, ecdsa

Supported key formats: PEM and SSH

--key-alias

RSA-1024

optionalstringCase-sensitive name for the public key created from the private key. The public key is used to verify the DSSE envelope that contains the evidence.

  • If the key-alias is included, DSSE verification will fail if the same key-name is not found in Artifactory.

  • If the key-alias is not included, DSSE verification with the public key is not performed during creation.

--markdown

md-file

optionalstringPath to a file that contains evidence in Markdown format.

--project

project-name

optionalstringName of the project associated with the evidence subject. This argument can be used with build, package, and Release Bundle evidence.
--provider-idoptionalstringName of the provider that created the evidence.
--sigstore-bundleoptionalstring

Path to a Sigstore bundle file containing a pre-signed DSSE envelope. If the evidence subject is not provided (using --subject-repo-path), Artifactory attempts to resolve the subject automatically from the DSSE envelope. Any subject resolution errors have exit code 2.

--sigstore-bundle is incompatible with --key, --key-alias, --predicate, --predicate-type, --subject-sha256, and all --attach-* flags.

--integrationoptionalstring

Indicates an attestation created by a 3rd-party tool that can be converted by the JFrog Platform into evidence.

Available values:
  • sonar: When enabled, the Evidence service automatically generates the predicate from SonarQube analysis data. Requires the SONAR_TOKEN or SONARQUBE_TOKEN environment variable to fetch the data from the SonarQube server. For more information, see Sonar Evidence Integration.

--attach-local

file-name

optionalstringPath to a local file to attach to the evidence. Incompatible with --attach-artifactory-path.

--attach-artifactory-temp-path

file-path

optionalstringDefines the path to a repository in Artifactory to be used for the temporary uploading of attachments. Users have write permissions to this repository. This value is persisted until it is next changed.

--attach-artifactory-path

file-path

optionalstringDefines the path to a file stored in Artifactory that will be attached to the evidence. Incompatible with --attach-local.
--formatoptionalstringOutput format:
  • json
  • table
If not defined, the command returns a confirmation message that evidence was created and optionally verified.

Requires CLI version 2.105.0 or later.

--typeoptionalstringCan contain the value gh-commiter, used together with --build-name.

Environment Variables

You can use the following environment variables as an alternative to using command parameters.

Environment VariableCommand ParameterNotes
JFROG_CLI_SIGNING_KEY--keyIf the environment variable is not defined, the --key command is mandatory.
JFROG_CLI_KEY_ALIAS--key-alias
EVIDENCE_ATTACHMENT_ARTIFACTORY_TEMP_PATH--attach-artifactory-temp-pathA third option is to add the following configuration to the Evidence YAML file:
attachment:
  artifactoryTempPath: <repo/path-in-artifactory>
📘

Note

In the unlikely event the public key is deleted from Artifactory, it may take up to 4 hours for the Evidence service to clear the key from the cache. Evidence can still be signed with the deleted key during this time.

Artifact Command Parameters

ParameterRequired/OptionalDescription
--subject-repo-pathrequired for artifact evidence

The target path of the artifact. Each evidence file must contain a single subject and include the path.

Artifacts located in local repositories aggregated inside virtual repositories are supported (evidence is added to the local path).

--subject-sha256optionalOptional digest (sha256) of the artifact.

  • If a digest is provided, it is verified against the subject's sha256 as it appears in Artifactory.

  • If a digest is not provided, the sha256 is taken from the path in Artifactory.

Package Command Parameters

ParameterRequired/OptionalDescription
--package-namerequired for package evidenceThe package name.
--package-versionrequired for package evidenceThe package version.
--package-repo-namerequired for package evidenceThe package repository name.

Build Command Parameters

ParameterRequired/OptionalDescription
--build-namerequired (unless environment variables are used)The build name.
--build-numberrequired (unless environment variables are used)The build number.
✅

Tip

You can use the JFROG_CLI_BUILD_NAME and JFROG_CLI_BUILD_NUMBER environment variables as an alternative to the build command parameters.

Release Bundle v2 Parameters

ParameterRequired/OptionalDescription
--release-bundlerequired for Release Bundle evidenceRelease Bundle name.
--release-bundle-versionrequired for Release Bundle evidenceRelease Bundle version.

Application Version Parameters

ParameterRequired/OptionalDescription
--application-keyrequired for application version evidenceApplication key.
--application-versionrequired for application version evidenceApplication version.
📘

Note

When DSSE verification is successful, the following message is displayed: Evidence successfully created and verified.

When DSSE verification is unsuccessful, the following message is displayed: Evidence successfully created but not verified due to missing/invalid public key.

Frequently Asked Questions

Common questions about creating evidence with the JFrog CLI.

plusFAQs
Q: How do I create evidence for an artifact using the JFrog CLI?

A: Run jf evd create with --subject-repo-path (and optionally --subject-sha256) along with --predicate and --predicate-type. See Artifact Command Parameters.

Q: What authentication is required to create and deploy evidence?

A: Use an access token or the web login mechanism. Basic authentication using a username or password is not supported. See Authentication.

Q: What happens if I don't include a key alias when creating evidence?

A: DSSE verification with the public key is not performed during creation. If you do include --key-alias, verification fails when that key alias isn't found in Artifactory.

Q: What is the difference between --attach-local and --attach-artifactory-path?

A: --attach-local attaches a file from your local machine, while --attach-artifactory-path attaches a file already stored in Artifactory. The two flags are incompatible with each other.

Q: Can I create evidence from a pre-signed Sigstore bundle instead of a predicate?

A: Yes. Use --sigstore-bundle with a path to the bundle file. This flag is incompatible with --key, --key-alias, --predicate, --predicate-type, --subject-sha256, and all --attach-* flags.

Related Topics

Updated 2 days ago

Did this page help you?