chore: enhance CLI help: add example for signer spec and add some more explaining lines by morri-son · Pull Request #1965 · open-component-model/open-component-model

morri-son · 2026-03-12T17:54:17Z

On-behalf-of: Gerald Morrison (SAP) gerald.morrison@sap.com

What this PR does / why we need it

Enhance the help for the ocm sign cv command and explain the signer spec and add an example config. Also explain signatureEncodingPolicy and Plain vs. PEM.

Testing

How to test the changes

Commands that test the change:

ocm sign cv --help

-->

Verification

I have tested the changes locally by running ocm

Summary by CodeRabbit

Documentation
- Enhanced help text and reference docs for component-version signing with clearer examples and notes.
- Renamed and clarified the credential config section to indicate credentials are resolved via .ocmconfig and must match the signature flag.
- Added a dedicated "signer spec" section explaining that signer specs configure algorithm/encoding (not credentials) and showing usage examples.
- Clarified default signing algorithm and encoding (RSASSA-PSS with Plain encoding) and how to override defaults.

On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com> Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>

coderabbitai · 2026-03-12T17:54:38Z

📝 Walkthrough

Walkthrough

This PR updates CLI help text and documentation for component-version signing to add an example signer-spec section, clarify that credentials are resolved via .ocmconfig, and state that signer specs configure algorithm/encoding (defaults: RSASSA-PSS with Plain encoding).

Changes

Cohort / File(s)	Summary
CLI Command Help `cli/cmd/sign/component-version/cmd.go`	Rewrote flag/help text: renamed credential example header, clarified credentials are resolved via `.ocmconfig`, expanded `--signer-spec` description to state it controls algorithm/encoding (not credentials) and documents defaults.
Documentation `cli/docs/reference/ocm_sign_component-version.md`	Added "Example Signer Spec File (--signer-spec)" section with YAML example and supported fields; updated credential example heading to include `(.ocmconfig)` and added explanatory notes about matching the `--signature` flag.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 A nibble, a note — docs trimmed and bright,
Signer specs penned in YAML light,
Credentials kept in .ocmconfig land,
Algorithms now clearly planned,
Hop, sign, and snack — all goes right! 🍪

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: enhancing CLI help documentation by adding examples and explanatory information for the signer spec.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

📝 Coding Plan

Generate coding plan for human review comments

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com> Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>

coderabbitai

🧹 Nitpick comments (1)

cli/docs/reference/ocm_sign_component-version.md (1)
94-94: Align wording with the new signer-spec scope.

Line 94 says “override algorithm defaults”, but the surrounding text now consistently states signer-spec controls both algorithm and encoding. Consider updating this line to avoid mixed messaging.
Suggested wording tweak
-# Use a signer specification file to override algorithm defaults
+# Use a signer specification file to override algorithm and encoding defaults
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@cli/docs/reference/ocm_sign_component-version.md` at line 94, Update the
heading text "Use a signer specification file to override algorithm defaults" to
reflect that signer-spec controls both algorithm and encoding (e.g., "Use a
signer specification file to override algorithm and encoding defaults") so
wording aligns with the rest of the document that describes signer-spec scope.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@cli/docs/reference/ocm_sign_component-version.md`:
- Line 94: Update the heading text "Use a signer specification file to override
algorithm defaults" to reflect that signer-spec controls both algorithm and
encoding (e.g., "Use a signer specification file to override algorithm and
encoding defaults") so wording aligns with the rest of the document that
describes signer-spec scope.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: d6f284b2-98c2-494b-9207-ae8b1fbfcdd1

📥 Commits

Reviewing files that changed from the base of the PR and between 71ace28 and 2393e25.

📒 Files selected for processing (2)

cli/cmd/sign/component-version/cmd.go
cli/docs/reference/ocm_sign_component-version.md

🚧 Files skipped from review as they are similar to previous changes (1)

cli/cmd/sign/component-version/cmd.go

fabianburth

Approved for now, I agree we need this. Although we are striving away from our brief command lines helps (not just here, in a lot of commands).

add example for signer spec and add some more explaining lines.

71ace28

On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com> Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>

morri-son requested a review from a team as a code owner March 12, 2026 17:54

morri-son added the kind/chore chore, maintenance, etc. label Mar 12, 2026

github-actions Bot added the size/s Small label Mar 12, 2026

matthiasbruns and others added 2 commits March 13, 2026 10:00

Merge branch 'main' into enhance-cli-help-for-signer-spec

3387152

add explanation about signatureEncodingPolicy and Plain vs. PEM

2393e25

On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com> Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>

coderabbitai Bot reviewed Mar 13, 2026

View reviewed changes

fabianburth approved these changes Mar 13, 2026

View reviewed changes

Merge branch 'main' into enhance-cli-help-for-signer-spec

d46757a

piotrjanik approved these changes Mar 13, 2026

View reviewed changes

jakobmoellerdev approved these changes Mar 13, 2026

View reviewed changes

jakobmoellerdev merged commit d7286c5 into open-component-model:main Mar 13, 2026
23 checks passed

coderabbitai Bot mentioned this pull request Apr 2, 2026

feat(cli): Add full PEM encoding support for signing and verifying component versions #2147

Merged

1 task

This was referenced Apr 14, 2026

feat: Add sigstore signing handler using Cosign CLI #2284

Closed

feat(website): add commit ID link to homepage footer #2287

Merged

coderabbitai Bot mentioned this pull request Apr 21, 2026

docs(adr): Minor corrections to ADR 0008 and align with signing handler implementation #2353

Merged

morri-son deleted the enhance-cli-help-for-signer-spec branch April 23, 2026 12:45

coderabbitai Bot mentioned this pull request May 4, 2026

feat(cli): integrate cosign signing handler [2/2] #2346

Merged

8 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: enhance CLI help: add example for signer spec and add some more explaining lines#1965

chore: enhance CLI help: add example for signer spec and add some more explaining lines#1965
jakobmoellerdev merged 4 commits into
open-component-model:mainfrom
morri-son:enhance-cli-help-for-signer-spec

morri-son commented Mar 12, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Mar 12, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Poem

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Uh oh!

fabianburth left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

morri-son commented Mar 12, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it

Testing

How to test the changes

Verification

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

fabianburth left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

morri-son commented Mar 12, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Mar 12, 2026 •

edited

Loading