Command line

The console tool: the commands most batches need, and the options behind them.

The console tool shares its entire core with the wizard, so anything the interface can do is one command away. These examples assume a source checkout; with a downloaded build, replace the interpreter call with `cachet-cli`.

Common commands

Sign a folder with the eID card, at the default b-lta level

cachet-cli --input ./pdfs --output ./signed --mode beid

Sign offline at the basic level, with no network access

cachet-cli --input ./pdfs --output ./signed --pades-level b-b

Stamp an image, validated against a template

cachet-cli --mode image --template ./pdfs/MODEL.pdf \
  --input ./pdfs --output ./signed \
  --image-path signature.png --page 1 --x 360 --y 150

Sign with a personal Azure Key Vault certificate

cachet-cli --mode azure \
  --azure-vault-url https://myorg-sign.vault.azure.net \
  --azure-trust-anchors ./internal-ca-chain.pem \
  --input ./pdfs --output ./signed

Open the graphical wizard

cachet

Options

The flags most runs need. The README documents the complete surface, including every Azure option.

Flag	Meaning
`--gui`	Launch the graphical interface; otherwise the tool runs in console mode.
`--input`	Files and folders to process. Folders are searched for PDFs.
`--output`	Output folder. Files are written as `{name}_signe.pdf` and never overwritten.
`--template`	Template PDF. When supplied, every input is validated against it.
`--mode`	`beid`, `azure` or `image`. Defaults to `beid`.
`--pades-level`	`b-b`, `b-t`, `b-lt` or `b-lta`. Defaults to `b-lta`.
`--page`	Target page: a 1-based number, or `first` / `last` resolved per document.
`--x --y`	Lower-left corner of the mark, in points from the bottom-left of the page. Omit both in eID mode for the bottom-right of the last page.
`--image-path`	The image to stamp. Required in image mode.
`--timestamp-url`	RFC 3161 timestamp authority for levels b-t and above.
`--digest`	Signature digest: `sha256` (default), `sha384` or `sha512`.
`--azure-vault-url`	Key Vault URL. Required in Azure mode.
`--azure-trust-anchors`	PEM or DER file, or a directory, holding the internal CA chain used as LTV trust anchors in Azure mode.
`--refresh-trust-list`	Force a re-download of the EU trusted list, bypassing the 24-hour cache.