Repository: sigstore/cosign
Pull request #4115 (2025-03-14 23:02:56)

Feat/non filename completions
<!--
Thanks for opening a pull request! Please do not just delete this text.  The three fields below are mandatory.

Please remember to:
- This PR requires an issue. If it is a new feature, the issue should proceed the PR and will have allowed sufficient time for discussions to take place. Please use
issue tags such as "Closes #XYZ" or "Resolves sigstore/repo-name#XYZ".
  [documentation](https://docs.github.com/en/github/managing-your-work-on-github/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword)
- ensure your commits are signed-off, as sigstore uses the [DCO](https://en.wikipedia.org/wiki/Developer_Certificate_of_Origin) using `git commit -s`, or `git commit -s --amend` if you want to amend already existing commits
- lastly, ensure there are no merge commits!

Thank you :)
-->

#### Summary
<!--
 Explain the **motivation** for making this change. What existing problem does the pull request solve? How can reviewers test this PR?
-->

As described in https://github.com/sigstore/community/issues/569

To test, generate and install shell completions and invoke completion for flags not taking filenames as arguments that are addressed in this PR, observe results.

#### Release Note
<!--
Add a release note for each of the following conditions:

* Config changes (additions, deletions, updates)
* API additions—new endpoint, new response fields, or newly accepted request parameters
* Database changes (any)
* Websocket additions or changes
* Anything noteworthy to an administrator running private sigstore instances (err on the side of over-communicating)
* New features and improvements, including behavioural changes, UI changes and CLI changes
* Bug fixes and fixes of previous known issues
* Deprecation warnings, breaking changes, or compatibility notes

If no release notes are required write NONE. Use past-tense.

-->

NONE

#### Documentation
<!--

Does this change require an update to documentation? How will users implement your new feature?

Please reference a PR within https://docs.sigstore.dev

-->

NONE

codecov[bot]: ## [Codecov](https://app.codecov.io/gh/sigstore/cosign/pull/4115?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) Report
Attention: Patch coverage is `0%` with `25 lines` in your changes missing coverage. Please review.
> Project coverage is 36.41%. Comparing base [(`2ef6022`)](https://app.codecov.io/gh/sigstore/cosign/commit/2ef6022f3f52299a56e0faacaed9eb2203b6b4a6?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) to head [(`5f5782d`)](https://app.codecov.io/gh/sigstore/cosign/commit/5f5782d8723023c85600e9b02c6136d6c2d81ebd?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore).
> Report is 345 commits behind head on main.

| [Files with missing lines](https://app.codecov.io/gh/sigstore/cosign/pull/4115?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) | Patch % | Lines |
|---|---|---|
| [cmd/cosign/cli/options/attach.go](https://app.codecov.io/gh/sigstore/cosign/pull/4115?src=pr&el=tree&filepath=cmd%2Fcosign%2Fcli%2Foptions%2Fattach.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#diff-Y21kL2Nvc2lnbi9jbGkvb3B0aW9ucy9hdHRhY2guZ28=) | 0.00% | [7 Missing :warning: ](https://app.codecov.io/gh/sigstore/cosign/pull/4115?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) |
| [cmd/cosign/cli/options/bundle.go](https://app.codecov.io/gh/sigstore/cosign/pull/4115?src=pr&el=tree&filepath=cmd%2Fcosign%2Fcli%2Foptions%2Fbundle.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#diff-Y21kL2Nvc2lnbi9jbGkvb3B0aW9ucy9idW5kbGUuZ28=) | 0.00% | [6 Missing :warning: ](https://app.codecov.io/gh/sigstore/cosign/pull/4115?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) |
| [cmd/cosign/cli/options/attest\_blob.go](https://app.codecov.io/gh/sigstore/cosign/pull/4115?src=pr&el=tree&filepath=cmd%2Fcosign%2Fcli%2Foptions%2Fattest_blob.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#diff-Y21kL2Nvc2lnbi9jbGkvb3B0aW9ucy9hdHRlc3RfYmxvYi5nbw==) | 0.00% | [5 Missing :warning: ](https://app.codecov.io/gh/sigstore/cosign/pull/4115?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) |
| [cmd/cosign/cli/options/attest.go](https://app.codecov.io/gh/sigstore/cosign/pull/4115?src=pr&el=tree&filepath=cmd%2Fcosign%2Fcli%2Foptions%2Fattest.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#diff-Y21kL2Nvc2lnbi9jbGkvb3B0aW9ucy9hdHRlc3QuZ28=) | 0.00% | [4 Missing :warning: ](https://app.codecov.io/gh/sigstore/cosign/pull/4115?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) |
| [cmd/cosign/cli/options/signblob.go](https://app.codecov.io/gh/sigstore/cosign/pull/4115?src=pr&el=tree&filepath=cmd%2Fcosign%2Fcli%2Foptions%2Fsignblob.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#diff-Y21kL2Nvc2lnbi9jbGkvb3B0aW9ucy9zaWduYmxvYi5nbw==) | 0.00% | [2 Missing :warning: ](https://app.codecov.io/gh/sigstore/cosign/pull/4115?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) |
| [cmd/cosign/cli/options/annotations.go](https://app.codecov.io/gh/sigstore/cosign/pull/4115?src=pr&el=tree&filepath=cmd%2Fcosign%2Fcli%2Foptions%2Fannotations.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#diff-Y21kL2Nvc2lnbi9jbGkvb3B0aW9ucy9hbm5vdGF0aW9ucy5nbw==) | 0.00% | [1 Missing :warning: ](https://app.codecov.io/gh/sigstore/cosign/pull/4115?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) |

<details><summary>Additional details and impacted files</summary>


```diff
@@            Coverage Diff             @@
##             main    #4115      +/-   ##
==========================================
- Coverage   40.10%   36.41%   -3.69%     
==========================================
  Files         155      210      +55     
  Lines       10044    13751    +3707     
==========================================
+ Hits         4028     5008     +980     
- Misses       5530     8115    +2585     
- Partials      486      628     +142     
```

</details>

[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/sigstore/cosign/pull/4115?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore).   
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore).

<details><summary>🚀 New features to boost your workflow: </summary>

- ❄ [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
</details>
bobcallaway: can you please run `make docgen`, and then add the `Signed-Off-By` via `git commit -s` to meet our DCO requirements 
scop: Done.

Patch:
diff --git a/cmd/cosign/cli/options/annotations.go b/cmd/cosign/cli/options/annotations.go
index bd3d1748..d5174c2a 100644
--- a/cmd/cosign/cli/options/annotations.go
+++ b/cmd/cosign/cli/options/annotations.go
@@ -50,4 +50,5 @@ func (o *AnnotationOptions) AnnotationsMap() (sigs.AnnotationsMap, error) {
 func (o *AnnotationOptions) AddFlags(cmd *cobra.Command) {
 	cmd.Flags().StringSliceVarP(&o.Annotations, "annotations", "a", nil,
 		"extra key=value pairs to sign")
+	_ = cmd.RegisterFlagCompletionFunc("annotations", cobra.NoFileCompletions)
 }
diff --git a/cmd/cosign/cli/options/attach.go b/cmd/cosign/cli/options/attach.go
index 17174305..06f562c7 100644
--- a/cmd/cosign/cli/options/attach.go
+++ b/cmd/cosign/cli/options/attach.go
@@ -82,11 +82,15 @@ func (o *AttachSBOMOptions) AddFlags(cmd *cobra.Command) {
 		"path to the sbom, or {-} for stdin")
 	_ = cmd.MarkFlagFilename("sbom", sbomExts...)
 
-	cmd.Flags().StringVar(&o.SBOMType, "type", "spdx",
-		"type of sbom (spdx|cyclonedx|syft)")
+	sbomTypes := []string{"spdx", "cyclonedx", "syft"}
+	cmd.Flags().StringVar(&o.SBOMType, "type", sbomTypes[0],
+		"type of sbom ("+strings.Join(sbomTypes, "|")+")")
+	_ = cmd.RegisterFlagCompletionFunc("type", cobra.FixedCompletions(sbomTypes, cobra.ShellCompDirectiveNoFileComp))
 
+	inputFormats := []string{ctypes.JSONInputFormat, ctypes.XMLInputFormat, ctypes.TextInputFormat}
 	cmd.Flags().StringVar(&o.SBOMInputFormat, "input-format", "",
-		"type of sbom input format (json|xml|text)")
+		"type of sbom input format ("+strings.Join(inputFormats, "|")+")")
+	_ = cmd.RegisterFlagCompletionFunc("input-format", cobra.FixedCompletions(inputFormats, cobra.ShellCompDirectiveNoFileComp))
 }
 
 func (o *AttachSBOMOptions) MediaType() (types.MediaType, error) {
diff --git a/cmd/cosign/cli/options/bundle.go b/cmd/cosign/cli/options/bundle.go
index a8a090d4..8168b308 100644
--- a/cmd/cosign/cli/options/bundle.go
+++ b/cmd/cosign/cli/options/bundle.go
@@ -16,6 +16,8 @@
 package options
 
 import (
+	"strings"
+
 	"github.com/spf13/cobra"
 )
 
@@ -66,6 +68,7 @@ func (o *BundleCreateOptions) AddFlags(cmd *cobra.Command) {
 
 	cmd.Flags().StringVar(&o.RekorURL, "rekor-url", "https://rekor.sigstore.dev",
 		"address of rekor STL server")
+	_ = cmd.RegisterFlagCompletionFunc("rekor-url", cobra.NoFileCompletions)
 
 	cmd.Flags().StringVar(&o.RFC3161TimestampPath, "rfc3161-timestamp", "",
 		"path to RFC3161 timestamp FILE")
@@ -78,9 +81,11 @@ func (o *BundleCreateOptions) AddFlags(cmd *cobra.Command) {
 	cmd.Flags().BoolVar(&o.Sk, "sk", false,
 		"whether to use a hardware security key")
 
-	cmd.Flags().StringVar(&o.Slot, "slot", "",
-		"security key slot to use for generated key (default: signature) "+
-			"(authentication|signature|card-authentication|key-management)")
+	slots := []string{"authentication", "signature", "card-authentication", "key-management"}
+	cmd.Flags().StringVar(&o.Slot, "slot", "signature",
+		"security key slot to use for generated key ("+
+			strings.Join(slots, "|")+")")
+	_ = cmd.RegisterFlagCompletionFunc("slot", cobra.FixedCompletions(slots, cobra.ShellCompDirectiveNoFileComp))
 
 	cmd.MarkFlagsMutuallyExclusive("bundle", "certificate")
 	cmd.MarkFlagsMutuallyExclusive("bundle", "signature")
diff --git a/cmd/cosign/cli/options/options.go b/cmd/cosign/cli/options/options.go
index 01434854..8eeafdc6 100644
--- a/cmd/cosign/cli/options/options.go
+++ b/cmd/cosign/cli/options/options.go
@@ -55,3 +55,8 @@ var signatureExts = []string{
 var wasmExts = []string{
 	"wasm",
 }
+
+var rekorEntryTypes = []string{
+	"dsse", // first one is the default
+	"intoto",
+}
diff --git a/cmd/cosign/cli/options/signblob.go b/cmd/cosign/cli/options/signblob.go
index db08489c..5afff3c8 100644
--- a/cmd/cosign/cli/options/signblob.go
+++ b/cmd/cosign/cli/options/signblob.go
@@ -101,9 +101,11 @@ func (o *SignBlobOptions) AddFlags(cmd *cobra.Command) {
 
 	cmd.Flags().StringVar(&o.TSAServerName, "timestamp-server-name", "",
 		"SAN name to use as the 'ServerName' tls.Config field to verify the mTLS connection to the TSA Server")
+	_ = cmd.RegisterFlagCompletionFunc("timestamp-server-name", cobra.NoFileCompletions)
 
 	cmd.Flags().StringVar(&o.TSAServerURL, "timestamp-server-url", "",
 		"url to the Timestamp RFC3161 server, default none. Must be the path to the API to request timestamp responses, e.g. https://freetsa.org/tsr")
+	_ = cmd.RegisterFlagCompletionFunc("timestamp-server-url", cobra.NoFileCompletions)
 
 	cmd.Flags().StringVar(&o.RFC3161TimestampPath, "rfc3161-timestamp", "",
 		"write the RFC3161 timestamp to a file")
diff --git a/doc/cosign_bundle_create.md b/doc/cosign_bundle_create.md
index 5fe3f6a7..ac72db4d 100644
--- a/doc/cosign_bundle_create.md
+++ b/doc/cosign_bundle_create.md
@@ -25,7 +25,7 @@ cosign bundle create [flags]
       --rfc3161-timestamp string   path to RFC3161 timestamp FILE
       --signature string           path to base64-encoded signature over attestation in DSSE format
       --sk                         whether to use a hardware security key
-      --slot string                security key slot to use for generated key (default: signature) (authentication|signature|card-authentication|key-management)
+      --slot string                security key slot to use for generated key (authentication|signature|card-authentication|key-management) (default "signature")
 ```
 
 ### Options inherited from parent commands


Test patch:
diff --git a/cmd/cosign/cli/options/attest.go b/cmd/cosign/cli/options/attest.go
index 6a4bc702..e852c4c1 100644
--- a/cmd/cosign/cli/options/attest.go
+++ b/cmd/cosign/cli/options/attest.go
@@ -16,6 +16,8 @@
 package options
 
 import (
+	"strings"
+
 	"github.com/spf13/cobra"
 )
 
@@ -87,8 +89,9 @@ func (o *AttestOptions) AddFlags(cmd *cobra.Command) {
 	cmd.Flags().BoolVar(&o.TlogUpload, "tlog-upload", true,
 		"whether or not to upload to the tlog")
 
-	cmd.Flags().StringVar(&o.RekorEntryType, "rekor-entry-type", "dsse",
-		"specifies the type to be used for a rekor entry upload. Options are intoto or dsse (default). ")
+	cmd.Flags().StringVar(&o.RekorEntryType, "rekor-entry-type", rekorEntryTypes[0],
+		"specifies the type to be used for a rekor entry upload ("+strings.Join(rekorEntryTypes, "|")+")")
+	_ = cmd.RegisterFlagCompletionFunc("rekor-entry-type", cobra.FixedCompletions(rekorEntryTypes, cobra.ShellCompDirectiveNoFileComp))
 
 	cmd.Flags().StringVar(&o.TSAClientCACert, "timestamp-client-cacert", "",
 		"path to the X.509 CA certificate file in PEM format to be used for the connection to the TSA Server")
@@ -104,6 +107,7 @@ func (o *AttestOptions) AddFlags(cmd *cobra.Command) {
 
 	cmd.Flags().StringVar(&o.TSAServerURL, "timestamp-server-url", "",
 		"url to the Timestamp RFC3161 server, default none. Must be the path to the API to request timestamp responses, e.g. https://freetsa.org/tsr")
+	_ = cmd.RegisterFlagCompletionFunc("timestamp-server-url", cobra.NoFileCompletions)
 
 	cmd.Flags().BoolVar(&o.RecordCreationTimestamp, "record-creation-timestamp", false,
 		"set the createdAt timestamp in the attestation artifact to the time it was created; by default, cosign sets this to the zero value")
diff --git a/cmd/cosign/cli/options/attest_blob.go b/cmd/cosign/cli/options/attest_blob.go
index 22e876b2..5b1b8135 100644
--- a/cmd/cosign/cli/options/attest_blob.go
+++ b/cmd/cosign/cli/options/attest_blob.go
@@ -15,6 +15,8 @@
 package options
 
 import (
+	"strings"
+
 	"github.com/spf13/cobra"
 )
 
@@ -97,6 +99,7 @@ func (o *AttestBlobOptions) AddFlags(cmd *cobra.Command) {
 
 	cmd.Flags().StringVar(&o.Hash, "hash", "",
 		"hash of blob in hexadecimal (base16). Used if you want to sign an artifact stored elsewhere and have the hash")
+	_ = cmd.RegisterFlagCompletionFunc("hash", cobra.NoFileCompletions)
 
 	cmd.Flags().BoolVarP(&o.SkipConfirmation, "yes", "y", false,
 		"skip confirmation prompts for non-destructive operations")
@@ -104,8 +107,9 @@ func (o *AttestBlobOptions) AddFlags(cmd *cobra.Command) {
 	cmd.Flags().BoolVar(&o.TlogUpload, "tlog-upload", true,
 		"whether or not to upload to the tlog")
 
-	cmd.Flags().StringVar(&o.RekorEntryType, "rekor-entry-type", "dsse",
-		"specifies the type to be used for a rekor entry upload. Options are intoto or dsse (default). ")
+	cmd.Flags().StringVar(&o.RekorEntryType, "rekor-entry-type", rekorEntryTypes[0],
+		"specifies the type to be used for a rekor entry upload ("+strings.Join(rekorEntryTypes, "|")+")")
+	_ = cmd.RegisterFlagCompletionFunc("rekor-entry-type", cobra.FixedCompletions(rekorEntryTypes, cobra.ShellCompDirectiveNoFileComp))
 
 	cmd.Flags().StringVar(&o.TSAClientCACert, "timestamp-client-cacert", "",
 		"path to the X.509 CA certificate file in PEM format to be used for the connection to the TSA Server")
@@ -121,6 +125,7 @@ func (o *AttestBlobOptions) AddFlags(cmd *cobra.Command) {
 
 	cmd.Flags().StringVar(&o.TSAServerURL, "timestamp-server-url", "",
 		"url to the Timestamp RFC3161 server, default none. Must be the path to the API to request timestamp responses, e.g. https://freetsa.org/tsr")
+	_ = cmd.RegisterFlagCompletionFunc("timestamp-server-url", cobra.NoFileCompletions)
 
 	cmd.Flags().StringVar(&o.RFC3161TimestampPath, "rfc3161-timestamp-bundle", "",
 		"path to an RFC 3161 timestamp bundle FILE")
diff --git a/doc/cosign_attest-blob.md b/doc/cosign_attest-blob.md
index 37b94b1f..cc42b92a 100644
--- a/doc/cosign_attest-blob.md
+++ b/doc/cosign_attest-blob.md
@@ -54,7 +54,7 @@ cosign attest-blob [flags]
       --output-certificate string         write the certificate to FILE
       --output-signature string           write the signature to FILE
       --predicate string                  path to the predicate file.
-      --rekor-entry-type string           specifies the type to be used for a rekor entry upload. Options are intoto or dsse (default).  (default "dsse")
+      --rekor-entry-type string           specifies the type to be used for a rekor entry upload (dsse|intoto) (default "dsse")
       --rekor-url string                  address of rekor STL server (default "https://rekor.sigstore.dev")
       --rfc3161-timestamp-bundle string   path to an RFC 3161 timestamp bundle FILE
       --sk                                whether to use a hardware security key
diff --git a/doc/cosign_attest.md b/doc/cosign_attest.md
index 1f647e83..d0074cfa 100644
--- a/doc/cosign_attest.md
+++ b/doc/cosign_attest.md
@@ -75,7 +75,7 @@ cosign attest [flags]
       --registry-server-name string                                                              SAN name to use as the 'ServerName' tls.Config field to verify the mTLS connection to the registry
       --registry-token string                                                                    registry bearer auth token
       --registry-username string                                                                 registry basic auth username
-      --rekor-entry-type string                                                                  specifies the type to be used for a rekor entry upload. Options are intoto or dsse (default).  (default "dsse")
+      --rekor-entry-type string                                                                  specifies the type to be used for a rekor entry upload (dsse|intoto) (default "dsse")
       --rekor-url string                                                                         address of rekor STL server (default "https://rekor.sigstore.dev")
       --replace                                                                                  
       --sk                                                                                       whether to use a hardware security key