rekor files

Manage files (path-addressed, versioned content) within a file type

Subcommands

`rekor files put <file_type> <path>`

Upload a local file to a path (e.g. rekor files put reports q3/summary.pdf --file ./summary.pdf)

--file <local> — Local file to upload
--content-type <type> — MIME type
--metadata <json> — Structured metadata, JSON (inline or @filename)
--label <label> — Free-string tag for the content version this upload creates (e.g. "proposal 1")
--if-match <sha256> — Compare-and-set: upload only if the current content hash matches

`rekor files get <file_type> <path>`

Download a file (or --meta for metadata only). --version N reads a specific retained content version.

--output <local> — Local file to save to (defaults to the file basename)
--meta — Print metadata JSON instead of downloading the content
--version <n> — Read a specific content version (default: latest)

`rekor files history <file_type> <path>`

List the content versions of a file (newest first)

--limit <n> — Max versions to return
--offset <n> — Pagination offset

`rekor files diff <file_type> <path>`

Diff two content versions of a file — metadata delta plus a text content diff

--from <n> — Base version number
--to <n> — Target version number

`rekor files list <file_type>`

List files by path prefix

--prefix <path> — Path prefix filter (e.g. q3/)
--depth <n> — Max folder depth below the prefix (1 = immediate children)
--limit <n> — Max results
--offset <n> — Pagination offset

`rekor files mv <file_type> <from> <to>`

Rename/move a file (the blob is untouched)

`rekor files rm <file_type> <path>`

Delete a file

-y, --yes — Skip confirmation prompt

`rekor files mount <file_type>`

Mint an S3 credential so any harness can mount this file type as a filesystem (s3fs, cloud mount SDKs). Read-only by default; the secret is shown once.

--expires-in <seconds> — Credential lifetime in seconds (default 30 days, max 90)
--mode <mode> — read_only (default) or read_write — the whole-bucket mode when no --path is given