| target | Target object name format=[<image:tag>, <dir path>, <git url>] | yes | — |
| all-env | Attach all environment variables | — | — |
| attest-config | Attestation config path | — | — |
| attest-default | Attestation default config, options=[sigstore sigstore-github x509 x509-env kms pubkey] | — | — |
| bom | Upload SBOM evidence and by product | — | — |
| build-type | Set build type | — | — |
| builder-id | Set builder id | — | — |
| by-product | Attach by product path | — | — |
| ca | x509 CA Chain path | — | — |
| cert | x509 Cert path | — | — |
| components | Select by products components groups, options=[metadata layers packages syft files dep commits base_image] | — | — |
| crl | x509 CRL path | — | — |
| crl-full-chain | Enable Full chain CRL verfication | — | — |
| depth | Git clone depth | — | — |
| disable-crl | Disable certificate revocation verificatoin | — | — |
| external | Add build external parameters | — | — |
| finished-on | Set metadata finished time (YYYY-MM-DDThh:mm:ssZ) | — | — |
| force | Force overwrite cache | — | — |
| format | Evidence format, options=[statement attest] | — | — |
| git-auth | Git repository authentication info, [format: 'username:password'] | — | — |
| git-branch | Git branch in the repository | — | — |
| git-commit | Git commit hash in the repository | — | — |
| git-tag | Git tag in the repository | — | — |
| invocation | Set metadata invocation ID | — | — |
| key | x509 Private key path | — | — |
| kms | Provide KMS key reference | — | — |
| oci | Enable OCI store | — | — |
| oci-repo | Select OCI custom attestation repo | — | — |
| pass | Private key password | — | — |
| payload | path of the decoded payload | — | — |
| platform | Select target platform, examples=windows/armv6, arm64 ..) | — | — |
| predicate | Import predicate path | — | — |
| pubkey | Public key path | — | — |
| skip-confirmation | Skip Sigstore Confirmation | — | — |
| source | Git repository source for target | — | — |
| source-asset-id | Source asset id for Git source repo | — | — |
| source-asset-name | Source asset name for Git source repo | — | — |
| source-asset-platform | Source asset platform for Git source repo | — | — |
| started-on | Set metadata started time (YYYY-MM-DDThh:mm:ssZ) | — | — |
| statement | Import statement path | — | — |
| cache-enable | Enable local cache | — | — |
| config | Configuration file path | — | — |
| deliverable | Mark as deliverable, options=[true, false] | — | — |
| env | Environment keys to include in evidence | — | — |
| gate-name | Policy Gate name | — | — |
| gate-type | Policy Gate type | — | — |
| input | Input Evidence target, format (\<parser>:\<file> or \<scheme>:\<name>:\<tag>) | — | — |
| label | Add Custom labels | — | — |
| level | Log depth level, options=[panic fatal error warning info debug trace] | — | — |
| log-context | Attach context to all logs | — | — |
| log-file | Output log to file | — | — |
| output-directory | Output directory path | — | ./scribe/valint |
| output-file | Output file name | — | — |
| pipeline-name | Pipeline name | — | — |
| predicate-type | Custom Predicate type (generic evidence format) | — | — |
| product-key | Product Key | — | — |
| product-version | Product Version | — | — |
| scribe-client-id | Scribe Client ID (deprecated) | — | — |
| scribe-client-secret | Scribe Client Token | — | — |
| scribe-disable | Disable scribe client | — | — |
| scribe-enable | Enable scribe client (deprecated) | — | — |
| scribe-url | Scribe API Url | — | — |
| structured | Enable structured logger | — | — |
| timeout | Timeout duration | — | — |
| verbose | Log verbosity level [-v,--verbose=1] = info, [-vv,--verbose=2] = debug | — | — |