@wpelevator/wp-release 0.13.0 → 0.14.0

package/dist/commands/args.js

@@ -1,7 +1,6 @@
 import { stat } from 'node:fs/promises';
-import { isAbsolute, relative, resolve } from 'node:path';
+import { resolve } from 'node:path';
 import { ValidationError } from "../errors.js";
-import { SIGNATURE_EXTENSION } from "../signing.js";
 import { getBoolean, getString, getStrings } from "./command.js";
 /**
  * Options shared by the commands that select files with .distignore and
@@ -63,39 +62,6 @@ export async function isDirectory(path) {
     const stats = await stat(path).catch(() => null);
     return Boolean(stats?.isDirectory());
 }
-/**
- * Ignore a file that the command writes or reads, such as the checksums
- * manifest, when it's inside the selected directory.
- *
- * @param rules     Matcher from loadFileRules().
- * @param sourceDir Selected directory.
- * @param path      Absolute file path.
- * @return The same matcher.
- */
-export function ignoreOwnFile(rules, sourceDir, path) {
-    const relativePath = relative(sourceDir, path).split('\\').join('/');
-    const isInside = relativePath &&
-        '..' !== relativePath &&
-        !relativePath.startsWith('../') &&
-        !isAbsolute(relativePath);
-    if (isInside) {
-        // Escape the gitignore wildcards so that the pattern matches only this file.
-        rules.add(`/${relativePath.replace(/[\\*?[\]!#]/g, '\\$&')}`);
-    }
-    return rules;
-}
-/**
- * Ignore the signature file that "wp-release sign" writes next to a file the
- * command writes, when it's inside the selected directory.
- *
- * @param rules     Matcher from loadFileRules().
- * @param sourceDir Selected directory.
- * @param path      Absolute path of the signed file.
- * @return The same matcher.
- */
-export function ignoreOwnSignature(rules, sourceDir, path) {
-    return ignoreOwnFile(rules, sourceDir, path + SIGNATURE_EXTENSION);
-}
 /**
  * Option for the source directory, which can also be the first positional
  * argument.

package/dist/commands/changeset-add.d.ts

@@ -29,7 +29,7 @@ declare const _default: {
             readonly type: "string";
         };
     };
-    run({ values, cwd, configFile, logger, terminal }: import("./command.ts").CommandContext): Promise<{
+    run({ values, cwd, configFile, tagFormat, logger, terminal }: import("./command.ts").CommandContext): Promise<{
         exitCode: number;
         result: {
             file: string;

package/dist/commands/changeset-add.js

@@ -94,7 +94,7 @@ export default {
   --summary <text>       Customer-facing release note
   --empty                Record that this change does not need a release
   --since <ref>          Compare changed files with this git ref (default:
-                         origin/<baseBranch>)
+                         <remote>/<baseBranch>)
   --name <name>          Changeset filename (default: random identifier)
 
 Use --package and --bump pairs for package releases, or --empty for changes
@@ -104,11 +104,12 @@ ref, including uncommitted files, and have no changeset yet. Without
 --package and --bump in a terminal, the command asks for the packages, with
 the changed ones preselected, their bumps and the release note.`,
     options: changesetAddArgs,
-    async run({ values, cwd, configFile, logger, terminal }) {
+    async run({ values, cwd, configFile, tagFormat, logger, terminal }) {
         const input = parseChangesetAddArgs(values);
         const release = new ChangesetRelease({
             cwd,
             ...(configFile ? { configFile } : {}),
+            ...(tagFormat ? { tagFormat } : {}),
         });
         const changeset = await getChangeset(release, input, terminal);
         // Adding resolves the package paths and rejects a package passed twice.

package/dist/commands/changeset-status.d.ts

@@ -26,7 +26,7 @@ declare const _default: {
             readonly type: "string";
         };
     };
-    run({ values, cwd, configFile, logger }: import("./command.ts").CommandContext): Promise<{
+    run({ values, cwd, configFile, tagFormat, logger }: import("./command.ts").CommandContext): Promise<{
         exitCode: number;
         result: {
             releases: {

package/dist/commands/changeset-status.js

@@ -10,11 +10,12 @@ export default {
 Exit status is 2 when a changed package has no changeset added since the comparison base.
 An empty changeset added since the comparison base counts as an explicit no-release decision.`,
     options: changesetStatusArgs,
-    async run({ values, cwd, configFile, logger }) {
+    async run({ values, cwd, configFile, tagFormat, logger }) {
         const { since } = parseChangesetStatusArgs(values);
         const result = await getChangesetStatus({
             cwd,
             ...(configFile ? { configFile } : {}),
+            ...(tagFormat ? { tagFormat } : {}),
             ...(since ? { since } : {}),
         });
         logger.summary(() => {

package/dist/commands/changeset-tag.d.ts

@@ -24,7 +24,7 @@ declare const _default: {
             readonly type: "string";
         };
     };
-    run({ values, cwd, configFile, logger }: import("./command.ts").CommandContext): Promise<{
+    run({ values, cwd, configFile, tagFormat, logger }: import("./command.ts").CommandContext): Promise<{
         exitCode: number;
         result: import("../changeset-release.ts").ChangesetTagResult;
     }>;

package/dist/commands/changeset-tag.js

@@ -14,7 +14,8 @@ export default {
                          the configured root (repeatable)
   --version <version>    Fail unless the single --package is at this version;
                          the version to tag for packages versioned by git tags
-  --push                 Push newly created tags to origin, one at a time
+  --push                 Push newly created tags to the configured remote
+                         (default: origin), one at a time
 
 Tags are created only when absent, so rerunning after a partial failure is
 safe. Before a tag is created, every configured version target must match the
@@ -23,11 +24,12 @@ and pre-release flag of its release, for a workflow step that creates the
 GitHub Release. --untagged lists only the releases that still need a tag, for
 example to release each of them with a separate workflow.`,
     options: changesetTagArgs,
-    async run({ values, cwd, configFile, logger }) {
+    async run({ values, cwd, configFile, tagFormat, logger }) {
         const args = parseChangesetTagArgs(values);
         const result = await tagChangesets({
             cwd,
             ...(configFile ? { configFile } : {}),
+            ...(tagFormat ? { tagFormat } : {}),
             ...args,
         });
         result.tags.forEach((item) => {

package/dist/commands/changeset-version.d.ts

@@ -36,7 +36,7 @@ declare const _default: {
             readonly type: "string";
         };
     };
-    run({ values, cwd, configFile, logger }: import("./command.ts").CommandContext): Promise<{
+    run({ values, cwd, configFile, tagFormat, logger }: import("./command.ts").CommandContext): Promise<{
         exitCode: number;
         result: {
             date: string;

package/dist/commands/changeset-version.js

@@ -28,11 +28,12 @@ The readme Stable tag keeps the last stable version.
 With --snapshot, build and publish the versioned files without committing
 them, for example to test a pull request.`,
     options: changesetVersionArgs,
-    async run({ values, cwd, configFile, logger }) {
+    async run({ values, cwd, configFile, tagFormat, logger }) {
         const args = parseChangesetVersionArgs(values);
         const result = await versionChangesets({
             cwd,
             ...(configFile ? { configFile } : {}),
+            ...(tagFormat ? { tagFormat } : {}),
             ...args,
         });
         result.releases.forEach((release) => logger.info(`${release.package.name}: ${release.currentVersion} → ${release.nextVersion} (${release.bump})`));

package/dist/commands/checksums.js

@@ -1,10 +1,10 @@
 import { basename, resolve } from 'node:path';
 import { CHECKSUMS_EXTENSION, createChecksums, writeChecksums, } from "../checksums.js";
-import { loadFileRules, resolveFileSelection } from "../file-selection.js";
+import { ignoreOwnFile, ignoreOwnSignature, loadFileRules, resolveFileSelection, } from "../file-selection.js";
 import { FILENAME_FORMAT, formatFilename } from "../filename.js";
 import { readPackageMeta } from "../package-meta.js";
 import { getChecksumsSummary } from "../summary.js";
-import { checkDirectory, fileSelectionArgs, getFileSelectionInput, getSourceDirArg, ignoreOwnFile, ignoreOwnSignature, resolveOutput, sourceDirArgs, } from "./args.js";
+import { checkDirectory, fileSelectionArgs, getFileSelectionInput, getSourceDirArg, resolveOutput, sourceDirArgs, } from "./args.js";
 import { getBoolean, getString } from "./command.js";
 export default {
     name: 'checksums',

package/dist/commands/command.d.ts

@@ -14,6 +14,8 @@ export interface CommandContext {
     cwd: string;
     /** Explicit JavaScript release config path from --config, if supplied. */
     configFile?: string;
+    /** Tag format from --tag-format, which replaces the tagFormat of the config. */
+    tagFormat?: string;
     /** Logger for the command output. */
     logger: Logger;
     /** Terminal for interactive prompts, only when the CLI runs in one and prints no JSON. */

package/dist/commands/deploy-git.d.ts

@@ -47,7 +47,7 @@ declare const _default: {
             type: "string";
         };
     };
-    run({ values, positionals, cwd, configFile, logger }: import("./command.ts").CommandContext): Promise<{
+    run({ values, positionals, cwd, configFile, tagFormat, logger }: import("./command.ts").CommandContext): Promise<{
         exitCode: number;
         result: {
             packages: import("../package-deploy.ts").PackageDeployPlanItem[];

package/dist/commands/deploy-git.js

@@ -114,7 +114,7 @@ Examples:
         ...packageDeployArgs,
         'dry-run': { type: 'boolean' },
     },
-    async run({ values, positionals, cwd, configFile, logger }) {
+    async run({ values, positionals, cwd, configFile, tagFormat, logger }) {
         const { ref, packages, list } = getPackageDeployArgs(values, positionals, TARGET_FLAGS);
         if (ref) {
             const deploys = await getGitDeploys({
@@ -123,6 +123,7 @@ Examples:
                 packages,
                 dryRun: getBoolean(values, 'dry-run'),
                 ...(configFile ? { configFile } : {}),
+                ...(tagFormat ? { tagFormat } : {}),
             });
             return list
                 ? listPackageDeploys(deploys, logger, ref)

package/dist/commands/deploy-svn.d.ts

@@ -76,7 +76,7 @@ declare const _default: {
             type: "string";
         };
     };
-    run({ values, positionals, cwd, configFile, logger }: import("./command.ts").CommandContext): Promise<{
+    run({ values, positionals, cwd, configFile, tagFormat, logger }: import("./command.ts").CommandContext): Promise<{
         exitCode: number;
         result: {
             packages: import("../package-deploy.ts").PackageDeployPlanItem[];

package/dist/commands/deploy-svn.js

@@ -135,7 +135,7 @@ Examples:
         ...packageDeployArgs,
         'dry-run': { type: 'boolean' },
     },
-    async run({ values, positionals, cwd, configFile, logger }) {
+    async run({ values, positionals, cwd, configFile, tagFormat, logger }) {
         const { ref, packages, list } = getPackageDeployArgs(values, positionals, TARGET_FLAGS);
         if (ref) {
             const deploys = await getSvnDeploys({
@@ -144,6 +144,7 @@ Examples:
                 packages,
                 dryRun: getBoolean(values, 'dry-run'),
                 ...(configFile ? { configFile } : {}),
+                ...(tagFormat ? { tagFormat } : {}),
             });
             return list
                 ? listPackageDeploys(deploys, logger, ref)

package/dist/commands/keygen.d.ts

@@ -1,3 +1,4 @@
+import type { SignatureFormat } from '../signing.ts';
 import type { CommandOutcome } from './command.ts';
 /** Generated Ed25519 signing keys. */
 export interface KeygenResult {
@@ -5,6 +6,8 @@ export interface KeygenResult {
     privateKey: string;
     /** Base64 Ed25519 public key for verification. */
     publicKey: string;
+    /** Public key in the form of each signature format. */
+    publicKeys: Record<SignatureFormat, string>;
 }
 declare const _default: {
     name: string;

package/dist/commands/keygen.js

@@ -8,7 +8,10 @@ export default {
     help: `Generate a signing key pair for "wp-release sign" and "wp-release verify".
 
 The private seed is printed once as WP_RELEASE_SIGNING_KEY. Store it securely
-and never commit it or share it. The public key can be distributed to verifiers.`,
+and never commit it or share it. The public key can be distributed to verifiers.
+It's also printed as a minisign public key for "minisign -V -P" and as an
+ssh-ed25519 public key for the allowed_signers file of "ssh-keygen -Y verify",
+since the same key signs every format of "wp-release sign".`,
     options: {},
     async run({ values, logger }) {
         if (getBoolean(values, 'github-output')) {
@@ -17,6 +20,8 @@ and never commit it or share it. The public key can be distributed to verifiers.
         const result = generateSigningKeyPair();
         logger.info(`WP_RELEASE_SIGNING_KEY=${result.privateKey}`);
         logger.info(`Public key: ${result.publicKey}`);
+        logger.info(`Minisign public key: ${result.publicKeys.minisign}`);
+        logger.info(`SSH public key: ${result.publicKeys.ssh}`);
         logger.info('Store the private seed securely; it cannot be recovered from the public key.');
         return { exitCode: 0, result };
     },

package/dist/commands/package-deploys.d.ts

@@ -22,6 +22,14 @@ export interface PackageDeployOutcome<Result> {
     package: string;
     /** Package, target and ref, with credentials redacted. */
     label: string;
+    /** Repository or WordPress.org plugin of the target, with credentials redacted. */
+    target: string;
+    /** Tag or branch that the deploy writes in the target. */
+    targetRef: string;
+    /** Host of a remote target repository, like github.com. */
+    targetHost?: string;
+    /** Path of a remote target repository on its host, like owner/repo. */
+    targetPath?: string;
     version?: string;
     branch?: string;
     /** Deploy result, unless it failed. */

package/dist/commands/package-deploys.js

@@ -78,6 +78,11 @@ async function runDeploy(item, deploy, logger) {
     const outcome = {
         package: item.package.name,
         label: item.label,
+        target: item.target,
+        targetRef: item.targetRef,
+        ...(item.targetHost
+            ? { targetHost: item.targetHost, targetPath: item.targetPath }
+            : {}),
         ...item.release,
     };
     try {

package/dist/commands/sign.d.ts

@@ -1,17 +1,35 @@
+import type { SignatureFormat } from '../signing.ts';
 import type { CommandOutcome } from './command.ts';
 /** Result of the sign command. */
 export interface SignResult {
-    /** Absolute paths of the written .sig files. */
+    /** Absolute paths of the written signature files. */
     signatures: string[];
+    /** Signature formats that were written. */
+    formats: SignatureFormat[];
     /** Base64 public key of the signing key. */
     publicKey: string;
+    /** Public key of the signing key in the form of each signature format. */
+    publicKeys: Record<SignatureFormat, string>;
 }
+/**
+ * Get the signature formats from the --format values, which can be repeated
+ * or comma-separated.
+ *
+ * @param  values Option values.
+ * @return Unique formats, the default when none are given.
+ * @throws {ValidationError} If a format is unknown.
+ */
+export declare function parseSignatureFormats(values: string[]): SignatureFormat[];
 declare const _default: {
     name: string;
     usage: string;
     summary: string;
     help: string;
     options: {
+        format: {
+            type: "string";
+            multiple: true;
+        };
         force: {
             type: "boolean";
         };

package/dist/commands/sign.js

@@ -2,8 +2,29 @@ import { resolve } from 'node:path';
 import { stat } from 'node:fs/promises';
 import { ValidationError } from "../errors.js";
 import { getSignSummary } from "../summary.js";
-import { SIGNING_KEY_ENV, getPublicKey, parseSigningKey, writeSignature, } from "../signing.js";
-import { getBoolean } from "./command.js";
+import { DEFAULT_SIGNATURE_FORMAT, SIGNATURE_FORMATS, SIGNING_KEY_ENV, getPublicKey, getPublicKeys, isSignatureFormat, parseSigningKey, writeSignature, } from "../signing.js";
+import { getBoolean, getStrings } from "./command.js";
+/**
+ * Get the signature formats from the --format values, which can be repeated
+ * or comma-separated.
+ *
+ * @param  values Option values.
+ * @return Unique formats, the default when none are given.
+ * @throws {ValidationError} If a format is unknown.
+ */
+export function parseSignatureFormats(values) {
+    const names = values
+        .flatMap((value) => value.split(','))
+        .map((name) => name.trim())
+        .filter(Boolean);
+    const unknown = names.filter((name) => !isSignatureFormat(name));
+    if (unknown.length) {
+        throw new ValidationError(`Unknown signature format ${unknown.join(', ')}, use ${Object.keys(SIGNATURE_FORMATS).join(', ')}.`);
+    }
+    return names.length
+        ? [...new Set(names.filter(isSignatureFormat))]
+        : [DEFAULT_SIGNATURE_FORMAT];
+}
 export default {
     name: 'sign',
     usage: 'sign <file>... [options]',
@@ -13,21 +34,32 @@ export default {
                           manifest
 
 Options:
-  --force                 Overwrite existing .sig files
+  --format <names>        Signature formats to write, comma-separated or
+                          repeated, like wordpress,minisign,ssh (default:
+                          wordpress):
+                          wordpress  <file>.sig for WordPress core's
+                                     verify_file_signature()
+                          minisign   <file>.minisig for "minisign -V"
+                          ssh        <file>.sshsig for "ssh-keygen -Y verify"
+                                     with the "file" namespace
+  --force                 Overwrite existing signature files
 
 The signing key is read from the ${SIGNING_KEY_ENV} environment variable, as a
 base64 32-byte Ed25519 seed or 64-byte libsodium secret key. There's no flag
 for it, since it would show in the process list.
 
-The signature is the one WordPress core's verify_file_signature() checks: a
-base64 Ed25519 signature of the raw SHA-384 digest of the file. Sign both
-the ZIP and the checksums manifest. Use --verbose to print the public key
-that belongs to the signing key.`,
+The wordpress signature is the one WordPress core's verify_file_signature()
+checks: a base64 Ed25519 signature of the raw SHA-384 digest of the file.
+All formats are signed by the same key. Sign both the ZIP and the checksums
+manifest. Use --verbose to print the public key of the signing key in the
+form of each format.`,
     options: {
+        format: { type: 'string', multiple: true },
         force: { type: 'boolean' },
     },
     async run({ values, positionals, cwd, logger, }) {
         const encoded = process.env[SIGNING_KEY_ENV];
+        const formats = parseSignatureFormats(getStrings(values, 'format'));
         if (!positionals.length) {
             throw new ValidationError('Pass the files to sign.');
         }
@@ -36,22 +68,25 @@ that belongs to the signing key.`,
         }
         const privateKey = parseSigningKey(encoded);
         const publicKey = getPublicKey(privateKey);
+        const publicKeys = getPublicKeys(privateKey);
         const paths = positionals.map((file) => resolve(cwd, file));
         await Promise.all(paths.map(async (path) => {
             if (!(await stat(path).catch(() => null))?.isFile()) {
                 throw new ValidationError(`${path} is not a file.`);
             }
         }));
-        logger.debug(`Signing with the public key ${publicKey}.`);
+        formats.forEach((format) => logger.debug(`Signing ${format} with the public key ${publicKeys[format]}.`));
         const signatures = [];
         const force = getBoolean(values, 'force');
+        const jobs = paths.flatMap((path) => formats.map((format) => ({ path, format })));
         // Sign in order, so that a failure leaves a predictable set of files.
-        for (const path of paths) {
-            const signaturePath = await writeSignature(path, privateKey, force);
+        for (const { path, format } of jobs) {
+            const signaturePath = await writeSignature(path, privateKey, force, format);
             logger.info(signaturePath);
             signatures.push(signaturePath);
         }
-        logger.summary((context) => getSignSummary(context, { signatures, publicKey }));
-        return { exitCode: 0, result: { signatures, publicKey } };
+        const result = { signatures, formats, publicKey, publicKeys };
+        logger.summary((context) => getSignSummary(context, result));
+        return { exitCode: 0, result };
     },
 };

package/dist/commands/verify.d.ts

@@ -24,6 +24,9 @@ declare const _default: {
         'public-key': {
             type: "string";
         };
+        'signature-format': {
+            type: "string";
+        };
     };
     run({ values, positionals, cwd, logger }: import("./command.ts").CommandContext): Promise<CommandOutcome<unknown>>;
 };

package/dist/commands/verify.js

@@ -4,28 +4,29 @@ import { tmpdir } from 'node:os';
 import { basename, isAbsolute, join, posix, resolve } from 'node:path';
 import { readChecksums, verifyChecksums } from "../checksums.js";
 import { downloadFile, isUrl } from "../download.js";
-import { loadFileRules, parseExclude } from "../file-selection.js";
+import { ignoreOwnFile, ignoreOwnSignature, loadFileRules, parseExclude, } from "../file-selection.js";
 import { ValidationError } from "../errors.js";
 import { readPackageMeta } from "../package-meta.js";
 import { logProblems } from "../report.js";
 import { getVerifySummary } from "../summary.js";
 import { extractZip, readZipEntries } from "../unzip.js";
-import { SIGNATURE_EXTENSION, parsePublicKey, verifyFileSignature, } from "../signing.js";
-import { checkDirectory, getSourceDirArg, ignoreOwnFile, ignoreOwnSignature, sourceDirArgs, } from "./args.js";
+import { DEFAULT_SIGNATURE_FORMAT, SIGNATURE_FORMATS, getSignaturePath, isSignatureFormat, parsePublicKey, verifyFileSignature, } from "../signing.js";
+import { checkDirectory, getSourceDirArg, sourceDirArgs } from "./args.js";
 import { getString, getStrings } from "./command.js";
 /**
  * Fail unless the manifest has a valid signature file.
  *
  * @param  checksumsPath Manifest path.
- * @param  publicKey     Base64 public key.
+ * @param  publicKey     Public key in any form that parsePublicKey() takes.
+ * @param  format        Signature format.
  * @throws {ValidationError} If the signature is missing or doesn't match.
  */
-async function checkSignature(checksumsPath, publicKey) {
-    const signaturePath = checksumsPath + SIGNATURE_EXTENSION;
+async function checkSignature(checksumsPath, publicKey, format) {
+    const signaturePath = getSignaturePath(checksumsPath, format);
     if (!existsSync(signaturePath)) {
         throw new ValidationError(`${signaturePath} doesn't exist.`);
     }
-    if (!(await verifyFileSignature(checksumsPath, signaturePath, parsePublicKey(publicKey)))) {
+    if (!(await verifyFileSignature(checksumsPath, signaturePath, parsePublicKey(publicKey), format))) {
         throw new ValidationError(`${signaturePath} isn't a valid signature of ${checksumsPath} for the public key.`);
     }
 }
@@ -111,15 +112,16 @@ function getEmbeddedPath(checksumsPath, embedded) {
  *
  * @param checksumsPath Manifest path.
  * @param path          Relative path of the embedded manifest, if any.
+ * @param format        Signature format.
  * @return Pairs of the originals and their copies.
  */
-function getCopyPairs(checksumsPath, path) {
+function getCopyPairs(checksumsPath, path, format) {
     return path
         ? [
             { original: checksumsPath, copy: path },
             {
-                original: checksumsPath + SIGNATURE_EXTENSION,
-                copy: path + SIGNATURE_EXTENSION,
+                original: getSignaturePath(checksumsPath, format),
+                copy: getSignaturePath(path, format),
             },
         ]
         : [];
@@ -172,12 +174,13 @@ async function hasSameContents(original, file) {
  * @param  input.manifest      Checksums manifest.
  * @param  input.checksumsPath Manifest path.
  * @param  input.embedded      Explicit path of the embedded manifest.
+ * @param  input.format        Signature format of the manifest signature.
  * @return The copies that were found to differ or be missing, and the paths of the existing copies.
  * @throws {ValidationError} If an explicit path can't be verified.
  */
 async function checkEmbeddedCopies(input) {
-    const { dir, manifest, checksumsPath, embedded } = input;
-    const pairs = getCopyPairs(checksumsPath, getEmbeddedPath(checksumsPath, embedded));
+    const { dir, manifest, checksumsPath, embedded, format } = input;
+    const pairs = getCopyPairs(checksumsPath, getEmbeddedPath(checksumsPath, embedded), format);
     if (embedded) {
         checkExplicitPairs(pairs, manifest);
     }
@@ -268,17 +271,19 @@ async function findVersionMismatch(dir, manifest) {
  * @param input.checksumsPath
  * @param input.exclude
  * @param input.embedded
+ * @param input.format
  * @param input.logger
  * @return Exit code and result.
  */
 async function verifyTarget(input) {
-    const { target, manifest, checksumsPath, exclude, embedded, logger } = input;
+    const { target, manifest, checksumsPath, exclude, embedded, format, logger, } = input;
     const { dir } = target;
     const copies = await checkEmbeddedCopies({
         dir,
         manifest,
         checksumsPath,
         embedded,
+        format,
     });
     const rules = ignoreOwnSignature(ignoreOwnFile(await loadFileRules({ exclude: parseExclude(exclude) }), dir, checksumsPath), dir, checksumsPath);
     copies.paths.forEach((copy) => ignoreOwnFile(rules, dir, join(dir, copy)));
@@ -338,17 +343,25 @@ Options:
                           builds for a release, instead of <source-dir>
   --root-folder <name>    Folder in the ZIP (default: the one folder that
                           every entry is in)
-  --embedded <path>       Where the manifest and its .sig are shipped inside the
-                          files, like includes/checksums.json. Both the
-                          --checksums file and its .sig must exist, both
+  --embedded <path>       Where the manifest and its signature are shipped in
+                          the files, like includes/checksums.json. Both the
+                          --checksums file and its signature must exist, both
                           copies must be shipped, and they must be identical
                           to them. Without this option, a file with the name
-                          of the --checksums file at the root (and its .sig)
-                          is a copy only when it exists, the matching original
-                          exists and the manifest doesn't list it
-  --public-key <key>      Base64 Ed25519 public key. Checks <checksums>.sig, as
-                          written by "wp-release sign", before comparing any
-                          file, and fails when it's missing or invalid
+                          of the --checksums file at the root (and its
+                          signature) is a copy only when it exists, the
+                          matching original exists and the manifest doesn't
+                          list it
+  --public-key <key>      Ed25519 public key, as base64, a minisign public key
+                          or an ssh-ed25519 public key. Checks the signature
+                          of the manifest, as written by "wp-release sign",
+                          before comparing any file, and fails when it's
+                          missing or invalid
+  --signature-format <name>
+                          Format of the manifest signature: wordpress
+                          (<checksums>.sig), minisign (<checksums>.minisig)
+                          or ssh (<checksums>.sshsig) (default: wordpress).
+                          Also selects the signature copy for --embedded
   --exclude <patterns>    Gitignore-style patterns to skip in both the directory
                           and the manifest, comma-separated or repeated
 
@@ -361,7 +374,7 @@ Unlike "checksums" and "zip", verify doesn't read .distignore, so that an
 ignore file inside the checked directory can't hide added files. Use
 --exclude to skip files that aren't part of the release.
 
-A manifest can't list itself. A copy of the manifest and of its .sig inside
+A manifest can't list itself. A copy of the manifest and of its signature in
 the checked files is therefore skipped, but it must be identical to the
 --checksums file. A path that the manifest lists is never skipped, and a
 file that isn't a matching copy is reported as extra. See --embedded for
@@ -372,6 +385,7 @@ where the copies are looked for.`,
         'root-folder': { type: 'string' },
         embedded: { type: 'string' },
         'public-key': { type: 'string' },
+        'signature-format': { type: 'string' },
         ...sourceDirArgs,
         exclude: { type: 'string', multiple: true },
     },
@@ -389,8 +403,12 @@ where the copies are looked for.`,
         }
         const checksumsPath = resolve(cwd, checksums);
         const publicKey = getString(values, 'public-key');
+        const format = getString(values, 'signature-format') ?? DEFAULT_SIGNATURE_FORMAT;
+        if (!isSignatureFormat(format)) {
+            throw new ValidationError(`Unknown signature format ${format}, use ${Object.keys(SIGNATURE_FORMATS).join(', ')}.`);
+        }
         if (publicKey) {
-            await checkSignature(checksumsPath, publicKey);
+            await checkSignature(checksumsPath, publicKey, format);
             logger.info(`Signature of ${checksumsPath} is valid.`);
         }
         const manifest = await readChecksums(checksumsPath);
@@ -407,6 +425,7 @@ where the copies are looked for.`,
                 checksumsPath,
                 exclude: getStrings(values, 'exclude'),
                 embedded: getString(values, 'embedded'),
+                format,
                 logger,
             });
         }