evidencectl jwk from-pem command reference
Convert one PEM public key into a public JWK whose kid is its RFC 7638 thumbprint.
Contract status
Section titled “Contract status”This page is generated from the public Clap command tree for Registry Stack source version 0.39.0 and catalog SHA-256 253866140eb693976375943a07adfce3e3efb9724c0b0fcdff8b37aed3ac7280. Hidden implementation commands are omitted.
Description
Section titled “Description”Convert one PEM public key into a public JWK whose kid is its RFC 7638 thumbprint. Accepts a PUBLIC KEY (SubjectPublicKeyInfo) or RSA PUBLIC KEY (PKCS #1) block: EC P-256 becomes ES256, EC P-384 becomes ES384, and RSA takes the algorithm named by --alg. A private key is refused.
evidencectl jwk from-pem [OPTIONS] <PEM>Constraints
Section titled “Constraints”| Condition | Requirement |
|---|---|
| Command invocation | --output <OUTPUT> and --output-dir <OUTPUT_DIR> cannot be used together. |
Arguments
Section titled “Arguments”| Argument | Always required | Default | Values | Environment | Description |
|---|---|---|---|---|---|
<PEM> | Yes | n/a | n/a | n/a | PEM public key file, or - to read standard input |
Options
Section titled “Options”| Option | Always required | Default | Values | Environment | Description |
|---|---|---|---|---|---|
--alg <ALG> | No | n/a | es256, es384, rs256, rs384 | n/a | JWS algorithm the key is published for; required for RSA keys |
--output <OUTPUT> | No | n/a | n/a | n/a | Write the JWK to this file instead of standard output |
--output-dir <OUTPUT_DIR> | No | n/a | n/a | n/a | Write the JWK into this existing directory as <kid>.jwk.json |
--force | No | n/a | n/a | n/a | Overwrite an existing output file |
--format <output_format> | No | human | human, json, junit | n/a | Select human-readable or machine-readable output. junit is accepted only by fixture runs (test and fixtures run) |
-h, --help | No | n/a | n/a | n/a | Print help (see a summary with ‘-h’) |
Generation contract
Section titled “Generation contract”Run npm run generate from docs/site after changing a public command, argument, option, default, environment binding, or help description.