| target | Target object name format=[<image:tag>, <dir path>, <git url>] | yes | — |
| attach-regex | Attach files content by regex | — | — |
| attest-config | Attestation config path | — | — |
| attest-default | Attestation default config, options=[sigstore sigstore-github x509 x509-env kms pubkey] | — | — |
| author-email | Set author email | — | — |
| author-name | Set author name | — | — |
| author-phone | Set author phone | — | — |
| base-image | Base image for the target | — | — |
| ca | x509 CA Chain path | — | — |
| cert | x509 Cert path | — | — |
| components | Select sbom components groups, options=[metadata layers packages syft files dep commits base_image] | — | — |
| crl | x509 CRL path | — | — |
| crl-full-chain | Enable Full chain CRL verfication | — | — |
| depth | Git clone depth | — | — |
| disable-crl | Disable certificate revocation verificatoin | — | — |
| filter-purl | Filter out purls by regex | — | — |
| filter-regex | Filter out files by regex | — | — |
| filter-scope | Filter packages by scope | — | — |
| force | Force overwrite cache | — | — |
| format | Evidence format, options=[json statement attest] | — | — |
| git-auth | Git repository authentication info, [format: 'username:password'] | — | — |
| git-branch | Git branch in the repository | — | — |
| git-commit | Git commit hash in the repository | — | — |
| git-tag | Git tag in the repository | — | — |
| key | x509 Private key path | — | — |
| kms | Provide KMS key reference | — | — |
| oci | Enable OCI store | — | — |
| oci-repo | Select OCI custom attestation repo | — | — |
| package-exclude-type | Exclude package type, options=[ruby python javascript java dpkg apk rpm go dotnet r rust binary sbom nix gem conan alpm cocoapods swift dart elixir php erlang github portage haskell kernel wordpress lua bitnami terraform] | — | — |
| package-group | Select package group, options=[index install all] | — | — |
| package-type | Select package type, options=[ruby python javascript java dpkg apk rpm go dotnet r rust binary sbom nix gem conan alpm cocoapods swift dart elixir php erlang github portage haskell kernel wordpress lua bitnami terraform] | — | — |
| pass | Private key password | — | — |
| payload | path of the decoded payload | — | — |
| platform | Select target platform, examples=windows/armv6, arm64 ..) | — | — |
| provenance | Include SLSA Provenance evidence | — | — |
| pubkey | Public key path | — | — |
| skip-confirmation | Skip Sigstore Confirmation | — | — |
| supplier-email | Set supplier email | — | — |
| supplier-name | Set supplier name | — | — |
| supplier-phone | Set supplier phone | — | — |
| supplier-url | Set supplier url | — | — |
| cache-enable | Enable local cache | — | — |
| config | Configuration file path | — | — |
| deliverable | Mark as deliverable, options=[true, false] | — | — |
| env | Environment keys to include in evidence | — | — |
| gate-name | Policy Gate name | — | — |
| gate-type | Policy Gate type | — | — |
| input | Input Evidence target, format (\<parser>:\<file> or \<scheme>:\<name>:\<tag>) | — | — |
| label | Add Custom labels | — | — |
| level | Log depth level, options=[panic fatal error warning info debug trace] | — | — |
| log-context | Attach context to all logs | — | — |
| log-file | Output log to file | — | — |
| output-directory | Output directory path | — | ./scribe/valint |
| output-file | Output file name | — | — |
| pipeline-name | Pipeline name | — | — |
| predicate-type | Custom Predicate type (generic evidence format) | — | — |
| product-key | Product Key | — | — |
| product-version | Product Version | — | — |
| scribe-client-id | Scribe Client ID (deprecated) | — | — |
| scribe-client-secret | Scribe Client Token | — | — |
| scribe-disable | Disable scribe client | — | — |
| scribe-enable | Enable scribe client (deprecated) | — | — |
| scribe-url | Scribe API Url | — | — |
| structured | Enable structured logger | — | — |
| timeout | Timeout duration | — | — |
| verbose | Log verbosity level [-v,--verbose=1] = info, [-vv,--verbose=2] = debug | — | — |