---
updatedAt: 2026-09-09T14:18:35.000Z
agentTools:
  siteIndex: https://docs.jfrog.com/llms.txt
  projectIndex: https://docs.jfrog.com/governance/llms.txt
---

# Create Evidence CLI

Create signed evidence for artifacts, packages, builds, and more using the JFrog CLI.

**Description**: Use the `create` command to create evidence files, which are then deployed to Artifactory. Options include:

* [Create evidence for JFrog entities](#create-evidence-for-artifacts)
* [Create evidence for other entities](#create-evidence-for-other-entities)

## Create Evidence for JFrog Entities

This section describes how to use the JFrog CLI to create evidence for artifacts managed by Artifactory, including entities such as builds, packages, application versions, and Release Bundle v2 versions.

### Authentication

To create and deploy evidence, use an access token or the web login mechanism for authentication. Basic authentication using a username or password is not supported.

### Syntax

**Artifact evidence:**

```shell
jf evd create --predicate <file-path> --predicate-type <predicate-type-uri> --subject-repo-path <target-path> --subject-sha256 <digest> --attach-local <file-name> --attach-artifactory-temp-path <target-path> --attach-artifactory-path <target-path> --key <local-private-key-path> --key-alias <public-key-name> --provider-id <provider-id>
```

**Package evidence:**

```shell
jf evd create --predicate <file-path> --predicate-type <predicate-type-uri> --package-name <name> --package-version <version-number> --package-repo-name <repo-name> --attach-local <file-name> --attach-artifactory-temp-path <target-path> --attach-artifactory-path <target-path> --key <local-private-key-path> --key-alias <public-key-name> --provider-id <provider-id>
```

**Build evidence:**

```shell
jf evd create --predicate <file-path> --predicate-type <predicate-type-uri> --build-name <name> --build-number <version-number> --attach-local <file-name> --attach-artifactory-temp-path <target-path> --attach-artifactory-path <target-path> --key <local-private-key-path> --key-alias <public-key-name> --provider-id <provider-id>
```

**Release Bundle v2 evidence:**

```shell
jf evd create --predicate <file-path> --predicate-type <predicate-type-uri> --release-bundle <name> --release-bundle-version <version-number> --attach-local <file-name> --attach-artifactory-temp-path <target-path> --attach-artifactory-path <target-path> --key <local-private-key-path> --key-alias <public-key-name> --provider-id <provider-id>
```

**Application version evidence:**

```shell
jf evd create --predicate <file-path> --predicate-type <predicate-type-uri> --application-key <name> --application-version <version-number> --attach-local <file-name> --attach-artifactory-temp-path <target-path> --attach-artifactory-path <target-path> --key <local-private-key-path> --key-alias <public-key-name> --provider-id <provider-id>
```

<Callout icon="📘" theme="info">
  **Note**

  For sample commands, see [Create Evidence CLI - Sample Commands](/docs/create-evidence-cli-sample-commands).
</Callout>

### Command Parameters

<Table align={["left","left","left","left"]}>
  <thead>
    <tr>
      <th>
        Parameter
      </th>

      <th>
        Required/Optional
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `--predicate`

        file-path
      </td>

      <td>
        required unless `--sigstore-bundle` is used
      </td>

      <td>
        string
      </td>

      <td>
        Defines the path to a locally-stored, arbitrary JSON file that contains the predicate (the content of the evidence).
      </td>
    </tr>

    <tr>
      <td>
        `--predicate-type`

        predicate-type-uri
      </td>

      <td>
        required unless `--sigstore-bundle` is used
      </td>

      <td>
        string
      </td>

      <td>
        The type of predicate defined by the JSON file. Sample predicate type URIs:

        ```text
        https://in-toto.io/attestation/link/v0.3
        https://in-toto.io/attestation/scai/attribute-report
        https://in-toto.io/attestation/runtime-trace/v0.1
        https://in-toto.io/attestation/test-result/v0.1
        https://in-toto.io/attestation/vulns
        ```
      </td>
    </tr>

    <tr>
      <td>
        `--key`

        local-private-key-path
      </td>

      <td>
        optional
      </td>

      <td>
        string
      </td>

      <td>
        Path to a private key. Supported key types: `rsa`, `ed25519`, `ecdsa`

        Supported key formats: PEM and SSH
      </td>
    </tr>

    <tr>
      <td>
        `--key-alias`

        RSA-1024
      </td>

      <td>
        optional
      </td>

      <td>
        string
      </td>

      <td>
        Case-sensitive name for the public key created from the private key. The public key is used to verify the DSSE envelope that contains the evidence.

        - If the `key-alias` is included, DSSE verification will fail if the same `key-name` is not found in Artifactory.

        - If the `key-alias` is not included, DSSE verification with the public key is not performed during creation.
      </td>
    </tr>

    <tr>
      <td>
        `--markdown`

        md-file
      </td>

      <td>
        optional
      </td>

      <td>
        string
      </td>

      <td>
        Path to a file that contains evidence in Markdown format.
      </td>
    </tr>

    <tr>
      <td>
        `--project`

        project-name
      </td>

      <td>
        optional
      </td>

      <td>
        string
      </td>

      <td>
        Name of the project associated with the evidence subject. This argument can be used with build, package, and Release Bundle evidence.
      </td>
    </tr>

    <tr>
      <td>
        `--provider-id`
      </td>

      <td>
        optional
      </td>

      <td>
        string
      </td>

      <td>
        Name of the provider that created the evidence.
      </td>
    </tr>

    <tr>
      <td>
        `--sigstore-bundle`
      </td>

      <td>
        optional
      </td>

      <td>
        string
      </td>

      <td>
        Path to a Sigstore bundle file containing a pre-signed DSSE envelope. If the evidence subject is not provided (using `--subject-repo-path`), Artifactory attempts to resolve the subject automatically from the DSSE envelope. Any subject resolution errors have exit code 2.

        `--sigstore-bundle` is incompatible with `--key`, `--key-alias`, `--predicate`, `--predicate-type`, `--subject-sha256`, and all `--attach-*` flags.
      </td>
    </tr>

    <tr>
      <td>
        `--integration`
      </td>

      <td>
        optional
      </td>

      <td>
        string
      </td>

      <td>
        Indicates an attestation created by a 3rd-party tool that can be converted by the JFrog Platform into evidence.

        Available values:

        - `sonar`: When enabled, the Evidence service automatically generates the predicate from SonarQube analysis data. Requires the `SONAR_TOKEN` or `SONARQUBE_TOKEN` environment variable to fetch the data from the SonarQube server. For more information, see [Sonar Evidence Integration](/docs/sonar-evidence-integration).
      </td>
    </tr>

    <tr>
      <td>
        `--attach-local`

        file-name
      </td>

      <td>
        optional
      </td>

      <td>
        string
      </td>

      <td>
        Path to a local file to attach to the evidence. Incompatible with `--attach-artifactory-path`.
      </td>
    </tr>

    <tr>
      <td>
        `--attach-artifactory-temp-path`

        file-path
      </td>

      <td>
        optional
      </td>

      <td>
        string
      </td>

      <td>
        Defines the path to a repository in Artifactory to be used for the temporary uploading of attachments. Users have write permissions to this repository. This value is persisted until it is next changed.
      </td>
    </tr>

    <tr>
      <td>
        `--attach-artifactory-path`

        file-path
      </td>

      <td>
        optional
      </td>

      <td>
        string
      </td>

      <td>
        Defines the path to a file stored in Artifactory that will be attached to the evidence. Incompatible with `--attach-local`.
      </td>
    </tr>

    <tr>
      <td>
        `--format`
      </td>

      <td>
        optional
      </td>

      <td>
        string
      </td>

      <td>
        Output format:

        - `json`
        - `table`

        If not defined, the command returns a confirmation message that evidence was created and optionally verified.

        Requires CLI version 2.105.0 or later.
      </td>
    </tr>

    <tr>
      <td>
        `--type`
      </td>

      <td>
        optional
      </td>

      <td>
        string
      </td>

      <td>
        Can contain the value `gh-commiter`, used together with `--build-name`.
      </td>
    </tr>
  </tbody>
</Table>

### Environment Variables

You can use the following environment variables as an alternative to using command parameters.

<Table align={["left","left","left"]}>
  <thead>
    <tr>
      <th>
        Environment Variable
      </th>

      <th>
        Command Parameter
      </th>

      <th>
        Notes
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `JFROG_CLI_SIGNING_KEY`
      </td>

      <td>
        `--key`
      </td>

      <td>
        If the environment variable is **not** defined, the `--key` command is mandatory.
      </td>
    </tr>

    <tr>
      <td>
        `JFROG_CLI_KEY_ALIAS`
      </td>

      <td>
        `--key-alias`
      </td>

      <td>

      </td>
    </tr>

    <tr>
      <td>
        `EVIDENCE_ATTACHMENT_ARTIFACTORY_TEMP_PATH`
      </td>

      <td>
        `--attach-artifactory-temp-path`
      </td>

      <td>
        A third option is to add the following configuration to the [Evidence YAML file](/docs/sonar-evidence-integration#configuration-options):

        ```yaml
        attachment:
          artifactoryTempPath: <repo/path-in-artifactory>
        ```
      </td>
    </tr>
  </tbody>
</Table>

<Callout icon="📘" theme="info">
  **Note**

  In the unlikely event the public key is deleted from Artifactory, it may take up to 4 hours for the Evidence service to clear the key from the cache. Evidence can still be signed with the deleted key during this time.
</Callout>

### Artifact Command Parameters

<Table align={["left","left",null,"left"]}>
  <thead>
    <tr>
      <th>
        Parameter
      </th>

      <th>
        Required/Optional
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `--subject-repo-path`
      </td>

      <td>
        required for artifact evidence
      </td>

      <td>
        string
      </td>

      <td>
        The target path of the artifact. Each evidence file must contain a single subject and include the path.

        Artifacts located in local repositories aggregated inside virtual repositories are supported (evidence is added to the local path).
      </td>
    </tr>

    <tr>
      <td>
        `--subject-sha256`
      </td>

      <td>
        optional
      </td>

      <td>
        string
      </td>

      <td>
        Optional digest (sha256) of the artifact.

        - If a digest is provided, it is verified against the subject's sha256 as it appears in Artifactory.

        - If a digest is not provided, the sha256 is taken from the path in Artifactory.
      </td>
    </tr>
  </tbody>
</Table>

### Package Command Parameters

| Parameter             | Required/Optional             | Type   | Description                  |
| :-------------------- | :---------------------------- | ------ | :--------------------------- |
| `--package-name`      | required for package evidence | string | The package name.            |
| `--package-version`   | required for package evidence | string | The package version.         |
| `--package-repo-name` | required for package evidence | string | The package repository name. |

### Build Command Parameters

| Parameter        | Required/Optional                                | Type   | Description       |
| :--------------- | :----------------------------------------------- | ------ | :---------------- |
| `--build-name`   | required (unless environment variables are used) | string | The build name.   |
| `--build-number` | required (unless environment variables are used) | string | The build number. |

<Callout icon="✅" theme="okay">
  **Tip**

  You can use the `JFROG_CLI_BUILD_NAME` and `JFROG_CLI_BUILD_NUMBER` environment variables as an alternative to the build command parameters.
</Callout>

### Release Bundle v2 Parameters

| Parameter                  | Required/Optional                    | Type   | Description             |
| :------------------------- | :----------------------------------- | ------ | :---------------------- |
| `--release-bundle`         | required for Release Bundle evidence | string | Release Bundle name.    |
| `--release-bundle-version` | required for Release Bundle evidence | string | Release Bundle version. |

### Application and Application Version Parameters

| Parameter                                       | Required/Optional                         | Type   | Description                                                                                                                                                                                                                                                                                                                                                                                                    |
| :---------------------------------------------- | :---------------------------------------- | ------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--application-key`                             | required for application version evidence | string | Application key.                                                                                                                                                                                                                                                                                                                                                                                               |
| `--application-version`                         | required for application version evidence | string | Application version.                                                                                                                                                                                                                                                                                                                                                                                           |
| `--application-key`<br /><br />application-name | optional                                  | string | Defines the application key. Use with `--application-version` to create AppTrust application version evidence. When used alone, it creates evidence on the application itself (translated as `--entity-type application --entity-id `{KEY}. For more information, see [Create Evidence for Other Entities](#create-evidence-for-other-entities).<br /><br />Incompatible with `--entity-repo` and `--project`. |

<Callout icon="📘" theme="info">
  **Note**

  When DSSE verification is successful, the following message is displayed: `Evidence successfully created and verified.`

  When DSSE verification is unsuccessful, the following message is displayed: `Evidence successfully created but not verified due to missing/invalid public key.`
</Callout>

## Create Evidence for Other Entities

This section describes how to use the JFrog CLI to create evidence for entities that are not directly managed by Artifactory, for example, GitHub commits.

### Authentication

To create and deploy evidence, use an access token or the web login mechanism for authentication. Basic authentication using a username or password is not supported.

### Syntax

```shell
jf evd create --entity-type <entity> --entity-id <entity-id> --project <project-name> --predicate <file-path> --predicate-type <predicate-type-uri> --key <local-private-key-path>
```

### Command Parameters

<Table align={["left","left","left","left"]}>
  <thead>
    <tr>
      <th>
        Parameter
      </th>

      <th>
        Required/Optional
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `--entity-type`

        entity-name
      </td>

      <td>
        required when creating non-artifact evidence unless `--application-key` is used on its own
      </td>

      <td>
        string
      </td>

      <td>
        Defines the entity type for which evidence is being created (for example, `gitCommit`).
      </td>
    </tr>

    <tr>
      <td>
        `--entity-id`
      </td>

      <td>
        required when `--entity-type` is used
      </td>

      <td>
        string
      </td>

      <td>
        The entity identifier.
      </td>
    </tr>

    <tr>
      <td>
        `--entity-repo`<br /><br />repo-path
      </td>

      <td>
        optional
      </td>

      <td>
        string
      </td>

      <td>
        Defines an explicit Artifactory repository key for non-artifact evidence. Incompatible with `--project` and `--application-key`.
      </td>
    </tr>

    <tr>
      <td>
        `--application-key`<br /><br />application-name
      </td>

      <td>
        optional
      </td>

      <td>
        string
      </td>

      <td>
        Defines the application key. Use with `--application-version` to create AppTrust application version evidence. When used alone, it creates evidence on the application itself (translated as `--entity-type application --entity-id `{KEY}.<br /><br />Incompatible with `--entity-repo` and `--project`.
      </td>
    </tr>

    <tr>
      <td>
        `--predicate`<br /><br />file-path
      </td>

      <td>
        required unless `--sigstore-bundle` is used
      </td>

      <td>
        string
      </td>

      <td>
        Defines the path to a locally-stored, arbitrary JSON file that contains the predicate (the content of the evidence).
      </td>
    </tr>

    <tr>
      <td>
        `--predicate-type`

        predicate-type-uri
      </td>

      <td>
        required unless `--sigstore-bundle` is used
      </td>

      <td>
        string
      </td>

      <td>
        The type of predicate defined by the JSON file. Sample predicate type URIs:

        ```text
        https://in-toto.io/attestation/link/v0.3
        https://in-toto.io/attestation/scai/attribute-report
        https://in-toto.io/attestation/runtime-trace/v0.1
        https://in-toto.io/attestation/test-result/v0.1
        https://in-toto.io/attestation/vulns
        ```
      </td>
    </tr>

    <tr>
      <td>
        `--key`

        local-private-key-path
      </td>

      <td>
        optional
      </td>

      <td>
        string
      </td>

      <td>
        Path to a private key. Supported key types: `rsa`, `ed25519`, `ecdsa`

        Supported key formats: PEM and SSH
      </td>
    </tr>

    <tr>
      <td>
        `--key-alias`

        RSA-1024
      </td>

      <td>
        optional
      </td>

      <td>
        string
      </td>

      <td>
        Case-sensitive name for the public key created from the private key. The public key is used to verify the DSSE envelope that contains the evidence.

        - If the `key-alias` is included, DSSE verification will fail if the same `key-name` is not found in Artifactory.

        - If the `key-alias` is not included, DSSE verification with the public key is not performed during creation.
      </td>
    </tr>

    <tr>
      <td>
        `--markdown`

        md-file
      </td>

      <td>
        optional
      </td>

      <td>
        string
      </td>

      <td>
        Path to a file that contains evidence in Markdown format.
      </td>
    </tr>

    <tr>
      <td>
        `--project`

        project-name
      </td>

      <td>
        optional
      </td>

      <td>
        string
      </td>

      <td>
        Name of the project associated with the evidence subject.&#x20;
      </td>
    </tr>

    <tr>
      <td>
        `--provider-id`
      </td>

      <td>
        optional
      </td>

      <td>
        string
      </td>

      <td>
        Name of the provider that created the evidence.
      </td>
    </tr>

    <tr>
      <td>
        `--sigstore-bundle`
      </td>

      <td>
        optional
      </td>

      <td>
        string
      </td>

      <td>
        Path to a Sigstore bundle file containing a pre-signed DSSE envelope. If the evidence subject is not provided (using `--subject-repo-path`), Artifactory attempts to resolve the subject automatically from the DSSE envelope. Any subject resolution errors have exit code 2.

        `--sigstore-bundle` is incompatible with `--key`, `--key-alias`, `--predicate`, `--predicate-type`, `--subject-sha256`, and all `--attach-*` flags.
      </td>
    </tr>

    <tr>
      <td>
        `--attach-local`

        file-name
      </td>

      <td>
        optional
      </td>

      <td>
        string
      </td>

      <td>
        Path to a local file to attach to the evidence. Incompatible with `--attach-artifactory-path`.
      </td>
    </tr>

    <tr>
      <td>
        `--attach-artifactory-temp-path`

        file-path
      </td>

      <td>
        optional
      </td>

      <td>
        string
      </td>

      <td>
        Defines the path to a repository in Artifactory to be used for the temporary uploading of attachments. Users have write permissions to this repository. This value is persisted until it is next changed.
      </td>
    </tr>

    <tr>
      <td>
        `--attach-artifactory-path`

        file-path
      </td>

      <td>
        optional
      </td>

      <td>
        string
      </td>

      <td>
        Defines the path to a file stored in Artifactory that will be attached to the evidence. Incompatible with `--attach-local`.
      </td>
    </tr>

    <tr>
      <td>
        `--format`
      </td>

      <td>
        optional
      </td>

      <td>
        string
      </td>

      <td>
        Output format:

        - `json`
        - `table`

        If not defined, the command returns a confirmation message that evidence was created and optionally verified.

        Requires CLI version 2.105.0 or later.
      </td>
    </tr>

    <tr>
      <td>
        `--type`
      </td>

      <td>
        optional
      </td>

      <td>
        string
      </td>

      <td>
        Can contain the value `gh-commiter`, used together with `--build-name`.
      </td>
    </tr>
  </tbody>
</Table>

## Frequently Asked Questions

Common questions about creating evidence with the JFrog CLI.

<Accordion title="FAQs" icon="plus">
  ##### Q: How do I create evidence for an artifact using the JFrog CLI?

  **A:** Run `jf evd create` with `--subject-repo-path` (and optionally `--subject-sha256`) along with `--predicate` and `--predicate-type`. See [Artifact Command Parameters](#artifact-command-parameters).

  ##### Q: What authentication is required to create and deploy evidence?

  **A:** Use an access token or the web login mechanism. Basic authentication using a username or password is not supported. See [Authentication](#authentication).

  ##### Q: What happens if I don't include a key alias when creating evidence?

  **A:** DSSE verification with the public key is not performed during creation. If you do include `--key-alias`, verification fails when that key alias isn't found in Artifactory.

  ##### Q: What is the difference between --attach-local and --attach-artifactory-path?

  **A:** `--attach-local` attaches a file from your local machine, while `--attach-artifactory-path` attaches a file already stored in Artifactory. The two flags are incompatible with each other.

  ##### Q: Can I create evidence from a pre-signed Sigstore bundle instead of a predicate?

  **A:** Yes. Use `--sigstore-bundle` with a path to the bundle file. This flag is incompatible with `--key`, `--key-alias`, `--predicate`, `--predicate-type`, `--subject-sha256`, and all `--attach-*` flags.
</Accordion>

## Related Topics

* [Evidence Service CLI](/docs/evidence-service-cli)
* [Generate Evidence Key Pair CLI](/docs/generate-evidence-key-pair-cli)
* [Get Evidence CLI](/docs/get-evidence-cli)
* [Verify Evidence CLI](/docs/verify-evidence-cli)