Add --help to /usr/bin/conformance tool?

[jas4711]

Hi! I'm packaging sigstore-go for Debian and I'm creating man pages for the /usr/bin/sigstore-go, /usr/bin/sigstore-go-signing and /usr/bin/oci-image-verification tool via help2man which uses the --help output to create a reasonable man page. However the /usr/bin/conformance tool that you should does not have a --help parameter. Could you add it?

Also, are all those four tools of intended use by users and make sense to have in /usr/bin? They are installed by your package, so I assume so, but sometimes this happens by mistake.

/Simon

[haydentherapper]

Hey Simon! The binaries in sigstore-go were meant as examples and not expected to be widely distributed.

For conformance, this was expected to only be run as part of the sigstore-conformance test suite, so it doesn't need --help.

@steiza @codysoyland if y'all have other thoughts as well

[jas4711]

Thanks -- maybe you could make it so that conformance is not installed by go install?

Surely sigstore-go is intended for use by (advanced) users? It is described how to use it directly in your README: https://github.com/sigstore/sigstore-go

/Simon

[haydentherapper]

Our eventual goal is to have a lightweight Cosign for verification. This might just be the sigstore-go CLI moved under Cosign, or something from scratch. We don't want these two CLIs to compete and keeping them together should simplify maintenance and avoid diverging UX options.

Need to sync with the other maintainers, so consider this my opinion for now.

[jas4711]

FWIW, in my latest upload into Debian I ship sigstore-go, sigstore-go-signing and oci-image-verification tools:

https://manpages.debian.org/unstable/sigstore-go/sigstore-go.1.en.html

https://manpages.debian.org/unstable/sigstore-go/sigstore-go-signing.1.en.html

https://manpages.debian.org/unstable/sigstore-go/oci-image-verification.1.en.html

This doesn't mean these are generally available for everyone, it just means that they are possible to install for a developer who are interested in them. It is fine to have really rarely used tools available in Debian, it doesn't cause harm, but may be useful for some developer who need access to the tools. Completely internal and not externally useful tools are fine to drop, and I read your reply as conformance being such an internal build-only tool that is never useful for a developer to ever run manually.

I opened #389 which is related, but I know believe this bug is addressed.

/Simon