// Generated by conforma CLI documentation tooling. DO NOT EDIT.
= ec sigstore initialize

Initializes Sigstore root to retrieve trusted certificate and key targets for verification

== Synopsis

Initializes Sigstore root to retrieve trusted certificate and key targets for verification.

The following options are used by default:
- The current trusted Sigstore TUF root is embedded inside ec at the time of release.
- Sigstore remote TUF repository is pulled from the CDN mirror at tuf-repo-cdn.sigstore.dev.

To provide an out-of-band trusted initial root.json, use the --root flag with a file or
URL reference. This will enable you to point ec to a separate TUF root.

Any updated TUF repository will be written to $HOME/.sigstore/root/<mirror_url>.

Trusted keys and certificate used in ec verification (e.g. verifying Fulcio issued certificates
with Fulcio root CA) are pulled from the trusted metadata.

[source,shell]
----
ec sigstore initialize [flags]
----

== Examples
Initialize root with distributed root keys, default mirror, and default out path.
ec sigstore initialize

Initialize with an out-of-band root key file, using the default mirror.
ec sigstore initialize --root <url>

Initialize with an out-of-band root key file and custom repository mirror.
ec sigstore initialize --mirror <url> --root <url>

== Options

-h, --help:: help for initialize (Default: false)
--mirror:: GCS bucket to a SigStore TUF repository, or HTTP(S) base URL, or file:/// for local filestore remote (air-gap) (Default: https://tuf-repo-cdn.sigstore.dev)
--root:: path to trusted initial root. defaults to embedded root
--root-checksum:: checksum of the initial root, required if root is downloaded via http(s). expects sha256 by default, can be changed to sha512 by providing sha512:<checksum>
--staging:: use the staging TUF repository (Default: false)

== Options inherited from parent commands

--debug:: same as verbose but also show function names and line numbers (Default: false)
--kubeconfig:: path to the Kubernetes config file to use
--logfile:: file to write the logging output. If not specified logging output will be written to stderr
--quiet:: less verbose output (Default: false)
--retry-duration:: base duration for exponential backoff calculation (Default: 1s)
--retry-factor:: exponential backoff multiplier (Default: 2)
--retry-jitter:: randomness factor for backoff calculation (0.0-1.0) (Default: 0.1)
--retry-max-retry:: maximum number of retry attempts (Default: 3)
--retry-max-wait:: maximum wait time between retries (Default: 3s)
--timeout:: max overall execution duration (Default: 5m0s)
--trace:: enable trace logging, set one or more comma separated values: none,all,perf,cpu,mem,opa,log (Default: none)
--verbose:: more verbose output (Default: false)

== See also

 * xref:ec_sigstore.adoc[ec sigstore - Perform certain sigstore operations]
