sbx kit push
| Description | Push a kit artifact to an OCI registry |
|---|---|
| Usage | sbx kit push DIRECTORY REFERENCE [flags] |
Experimental
This command is experimental.
Experimental features are intended for testing and feedback as their functionality or design may change between releases without warning or can be removed entirely in a future release.
Description
Package and push a kit artifact directory to an OCI registry.
The directory must contain a valid spec.yaml. The reference should be in the format "registry/repo:tag" (e.g., "ghcr.io/myorg/my-plugin:1.0").
The OCI artifact format is selected from the kit's spec.yaml: schemaVersion: "1" → legacy ZIP-based artifact schemaVersion: "2" → v2 tar+gzip layer with the spec in the manifest config blob and standard OCI annotations (so distribution tooling can read kit metadata without pulling layers)
With --sign, the pushed manifest is signed and the Sigstore bundle is attached to the kit as an OCI referrer. Signing is keyless (Fulcio + Rekor) unless --key is given for key-based signing.
Every push also attaches a SLSA provenance attestation as an OCI referrer, recording the kit's content digests, the declared sandbox image, and the source git commit when the directory is a working tree. The provenance is unsigned unless --sign is given, in which case it is signed as a DSSE in-toto attestation with the same identity or key.
Authentication uses the Docker credential store.
Options
| Option | Default | Description |
|---|---|---|
--identity-token | OIDC identity token for keyless signing; defaults to the ambient CI provider, then an interactive browser login | |
--identity-token-file | File holding the OIDC identity token; keeps it out of the process arguments | |
--key | Private key for key-based signing (PEM); omit for keyless signing | |
--sign | Sign the pushed kit and attach the signature as an OCI referrer | |
--tlog-upload | true | Upload the keyless signature to the Rekor transparency log; set false for private kits |
Global options
| Option | Default | Description |
|---|---|---|
-D, --debug | Enable debug logging |