Add step-cli (binary) ebuild

app-crypt/step-cli/step-cli-0.31.0.ebuild

@@ -0,0 +1,40 @@
+# Copyright 2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+MY_P=cli
+
+DESCRIPTION=""
+HOMEPAGE=""
+SRC_URI="https://github.com/smallstep/${MY_P}/releases/download/v${PVR}/step_linux_amd64.tar.gz -> ${P}.tar.gz
+	verify-sig? ( https://github.com/smallstep/${MY_P}/releases/download/v${PVR}/step_linux_amd64.tar.gz.sigstore.json -> ${P}.tar.gz.sigstore.json )"
+
+LICENSE=""
+SLOT="0"
+KEYWORDS="amd64"
+
+DEPEND=""
+RDEPEND="${DEPEND}"
+BDEPEND="verify-sig? ( app-containers/cosign )"
+
+IUSE="-verify-sig"
+
+S="${WORKDIR}/step_linux_amd64"
+
+src_unpack() {
+	if use verify-sig ; then
+		# Call cosign here to verify the sig
+		cosign verify-blob \
+			--bundle "${P}.sigstore.json" \
+			--certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \
+			--certificate-oidc-issuer https://token.actions.githubusercontent.com \
+			"${P}.tar.gz" || die "Signature verification failed"
+	fi
+
+	unpack "${P}.tar.gz"
+}
+
+src_install() {
+	dobin bin/step
+}