From 58cd57d282dc0a40341e80de6ebca5c16ba6d957 Mon Sep 17 00:00:00 2001
From: krakenhavoc <krakenhavoc@protonmail.com>
Date: Thu, 9 Apr 2026 18:50:38 +0000
Subject: [PATCH 1/4] fix: save CLI archive with original filename for checksum
 verification

sha256sum -c expects the file at the path listed in checksums.txt.
Downloading to cli.tar.gz caused a 'No such file or directory' error
during verification.
---
 entrypoint.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/entrypoint.sh b/entrypoint.sh
index 22b0a74..e01f9f0 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -57,12 +57,12 @@ download_cli() {
   checksums_url="https://github.com/krakenkey/cli/releases/download/${version}/checksums.txt"
 
   echo "::group::Downloading krakenkey-cli ${version} (${os}/${arch})"
-  curl -fsSL "${download_url}" -o /tmp/cli.tar.gz
+  curl -fsSL "${download_url}" -o "/tmp/${binary_name}"
   curl -fsSL "${checksums_url}" -o /tmp/checksums.txt
 
   # Verify checksum
   (cd /tmp && grep "${binary_name}" checksums.txt | sha256sum -c -)
-  tar -xzf /tmp/cli.tar.gz -C /tmp krakenkey
+  tar -xzf "/tmp/${binary_name}" -C /tmp krakenkey
   chmod +x /tmp/krakenkey
   echo "::endgroup::"
 

From 371188e98b65059d73085325b40fa289cad9a446 Mon Sep 17 00:00:00 2001
From: krakenhavoc <krakenhavoc@protonmail.com>
Date: Thu, 9 Apr 2026 18:59:08 +0000
Subject: [PATCH 2/4] fix: add CLI to PATH directly instead of using
 GITHUB_PATH

GITHUB_PATH changes only take effect in subsequent steps, not within
the same composite action step. Use export PATH instead.
---
 entrypoint.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/entrypoint.sh b/entrypoint.sh
index e01f9f0..f969673 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -66,7 +66,7 @@ download_cli() {
   chmod +x /tmp/krakenkey
   echo "::endgroup::"
 
-  echo "/tmp" >> "${GITHUB_PATH}"
+  export PATH="/tmp:${PATH}"
 }
 
 # ── 4. Execute command ───────────────────────────────────────────

From 87021accc336ad174848e6ad40469e69440e5152 Mon Sep 17 00:00:00 2001
From: krakenhavoc <krakenhavoc@protonmail.com>
Date: Thu, 9 Apr 2026 19:01:40 +0000
Subject: [PATCH 3/4] fix: correct CLI flag syntax for global vs subcommand
 flags

Global flags (--api-url, --output, --no-color) must appear before the
subcommand. Subcommand flags use single-dash syntax (-domain, -wait).
---
 entrypoint.sh | 55 ++++++++++++++++++++++++++++-----------------------
 1 file changed, 30 insertions(+), 25 deletions(-)

diff --git a/entrypoint.sh b/entrypoint.sh
index f969673..fd27096 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -72,56 +72,60 @@ download_cli() {
 # ── 4. Execute command ───────────────────────────────────────────
 execute_issue() {
   local args=(
-    cert issue
     --api-url "${INPUT_API_URL}"
     --output json
     --no-color
-    --domain "${INPUT_DOMAIN}"
-    --key-type "${INPUT_KEY_TYPE}"
-    --auto-renew="${INPUT_AUTO_RENEW}"
-    --wait="${INPUT_WAIT}"
-    --poll-interval "${INPUT_POLL_INTERVAL}"
-    --poll-timeout "${INPUT_POLL_TIMEOUT}"
-    --key-out "${INPUT_KEY_PATH}"
-    --csr-out "${INPUT_CSR_PATH}"
-    --out "${INPUT_CERT_PATH}"
+    cert issue
+    -domain "${INPUT_DOMAIN}"
+    -key-type "${INPUT_KEY_TYPE}"
+    -poll-interval "${INPUT_POLL_INTERVAL}"
+    -poll-timeout "${INPUT_POLL_TIMEOUT}"
+    -key-out "${INPUT_KEY_PATH}"
+    -csr-out "${INPUT_CSR_PATH}"
+    -out "${INPUT_CERT_PATH}"
   )
-  [[ -n "${INPUT_SAN}" ]] && args+=(--san "${INPUT_SAN}")
-  [[ -n "${INPUT_SUBJECT_ORG}" ]] && args+=(--org "${INPUT_SUBJECT_ORG}")
-  [[ -n "${INPUT_SUBJECT_OU}" ]] && args+=(--ou "${INPUT_SUBJECT_OU}")
-  [[ -n "${INPUT_SUBJECT_COUNTRY}" ]] && args+=(--country "${INPUT_SUBJECT_COUNTRY}")
+  [[ "${INPUT_AUTO_RENEW}" == "true" ]] && args+=(-auto-renew)
+  [[ "${INPUT_WAIT}" == "true" ]] && args+=(-wait)
+  [[ -n "${INPUT_SAN}" ]] && args+=(-san "${INPUT_SAN}")
+  [[ -n "${INPUT_SUBJECT_ORG}" ]] && args+=(-org "${INPUT_SUBJECT_ORG}")
+  [[ -n "${INPUT_SUBJECT_OU}" ]] && args+=(-ou "${INPUT_SUBJECT_OU}")
+  [[ -n "${INPUT_SUBJECT_COUNTRY}" ]] && args+=(-country "${INPUT_SUBJECT_COUNTRY}")
 
   KK_API_KEY="${INPUT_API_KEY}" krakenkey "${args[@]}"
 }
 
 execute_renew() {
-  local result
-  result=$(KK_API_KEY="${INPUT_API_KEY}" krakenkey cert renew "${INPUT_CERT_ID}" \
+  local result wait_args=()
+  [[ "${INPUT_WAIT}" == "true" ]] && wait_args+=(-wait)
+  result=$(KK_API_KEY="${INPUT_API_KEY}" krakenkey \
     --api-url "${INPUT_API_URL}" \
     --output json \
     --no-color \
-    --wait="${INPUT_WAIT}" \
-    --poll-interval "${INPUT_POLL_INTERVAL}" \
-    --poll-timeout "${INPUT_POLL_TIMEOUT}")
+    cert renew "${INPUT_CERT_ID}" \
+    "${wait_args[@]}" \
+    -poll-interval "${INPUT_POLL_INTERVAL}" \
+    -poll-timeout "${INPUT_POLL_TIMEOUT}")
   echo "${result}"
 
   local status
   status=$(echo "${result}" | jq -r '.status')
   if [[ "${status}" == "issued" ]]; then
-    KK_API_KEY="${INPUT_API_KEY}" krakenkey cert download "${INPUT_CERT_ID}" \
+    KK_API_KEY="${INPUT_API_KEY}" krakenkey \
       --api-url "${INPUT_API_URL}" \
       --output json \
       --no-color \
-      --out "${INPUT_CERT_PATH}" > /dev/null
+      cert download "${INPUT_CERT_ID}" \
+      -out "${INPUT_CERT_PATH}" > /dev/null
   fi
 }
 
 execute_download() {
-  KK_API_KEY="${INPUT_API_KEY}" krakenkey cert download "${INPUT_CERT_ID}" \
+  KK_API_KEY="${INPUT_API_KEY}" krakenkey \
     --api-url "${INPUT_API_URL}" \
     --output json \
     --no-color \
-    --out "${INPUT_CERT_PATH}"
+    cert download "${INPUT_CERT_ID}" \
+    -out "${INPUT_CERT_PATH}"
 }
 
 # ── 5. Parse output and set Action outputs ───────────────────────
@@ -139,10 +143,11 @@ set_outputs() {
 
   if [[ "${status}" == "issued" ]]; then
     local details
-    details=$(KK_API_KEY="${INPUT_API_KEY}" krakenkey cert show "${cert_id}" \
+    details=$(KK_API_KEY="${INPUT_API_KEY}" krakenkey \
       --api-url "${INPUT_API_URL}" \
       --output json \
-      --no-color 2>/dev/null || true)
+      --no-color \
+      cert show "${cert_id}" 2>/dev/null || true)
 
     if [[ -n "${details}" ]]; then
       {

From ebe27f8514bde7963bdec29e20bb887d93700042 Mon Sep 17 00:00:00 2001
From: krakenhavoc <krakenhavoc@protonmail.com>
Date: Mon, 13 Apr 2026 12:24:19 +0000
Subject: [PATCH 4/4] chore: update entrypoint to use double-dash flags
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Match the CLI's pflag migration — all subcommand flags now use
--double-dash syntax consistently.
---
 entrypoint.sh | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/entrypoint.sh b/entrypoint.sh
index fd27096..f643f42 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -76,35 +76,35 @@ execute_issue() {
     --output json
     --no-color
     cert issue
-    -domain "${INPUT_DOMAIN}"
-    -key-type "${INPUT_KEY_TYPE}"
-    -poll-interval "${INPUT_POLL_INTERVAL}"
-    -poll-timeout "${INPUT_POLL_TIMEOUT}"
-    -key-out "${INPUT_KEY_PATH}"
-    -csr-out "${INPUT_CSR_PATH}"
-    -out "${INPUT_CERT_PATH}"
+    --domain "${INPUT_DOMAIN}"
+    --key-type "${INPUT_KEY_TYPE}"
+    --poll-interval "${INPUT_POLL_INTERVAL}"
+    --poll-timeout "${INPUT_POLL_TIMEOUT}"
+    --key-out "${INPUT_KEY_PATH}"
+    --csr-out "${INPUT_CSR_PATH}"
+    --out "${INPUT_CERT_PATH}"
   )
-  [[ "${INPUT_AUTO_RENEW}" == "true" ]] && args+=(-auto-renew)
-  [[ "${INPUT_WAIT}" == "true" ]] && args+=(-wait)
-  [[ -n "${INPUT_SAN}" ]] && args+=(-san "${INPUT_SAN}")
-  [[ -n "${INPUT_SUBJECT_ORG}" ]] && args+=(-org "${INPUT_SUBJECT_ORG}")
-  [[ -n "${INPUT_SUBJECT_OU}" ]] && args+=(-ou "${INPUT_SUBJECT_OU}")
-  [[ -n "${INPUT_SUBJECT_COUNTRY}" ]] && args+=(-country "${INPUT_SUBJECT_COUNTRY}")
+  [[ "${INPUT_AUTO_RENEW}" == "true" ]] && args+=(--auto-renew)
+  [[ "${INPUT_WAIT}" == "true" ]] && args+=(--wait)
+  [[ -n "${INPUT_SAN}" ]] && args+=(--san "${INPUT_SAN}")
+  [[ -n "${INPUT_SUBJECT_ORG}" ]] && args+=(--org "${INPUT_SUBJECT_ORG}")
+  [[ -n "${INPUT_SUBJECT_OU}" ]] && args+=(--ou "${INPUT_SUBJECT_OU}")
+  [[ -n "${INPUT_SUBJECT_COUNTRY}" ]] && args+=(--country "${INPUT_SUBJECT_COUNTRY}")
 
   KK_API_KEY="${INPUT_API_KEY}" krakenkey "${args[@]}"
 }
 
 execute_renew() {
   local result wait_args=()
-  [[ "${INPUT_WAIT}" == "true" ]] && wait_args+=(-wait)
+  [[ "${INPUT_WAIT}" == "true" ]] && wait_args+=(--wait)
   result=$(KK_API_KEY="${INPUT_API_KEY}" krakenkey \
     --api-url "${INPUT_API_URL}" \
     --output json \
     --no-color \
     cert renew "${INPUT_CERT_ID}" \
     "${wait_args[@]}" \
-    -poll-interval "${INPUT_POLL_INTERVAL}" \
-    -poll-timeout "${INPUT_POLL_TIMEOUT}")
+    --poll-interval "${INPUT_POLL_INTERVAL}" \
+    --poll-timeout "${INPUT_POLL_TIMEOUT}")
   echo "${result}"
 
   local status
@@ -115,7 +115,7 @@ execute_renew() {
       --output json \
       --no-color \
       cert download "${INPUT_CERT_ID}" \
-      -out "${INPUT_CERT_PATH}" > /dev/null
+      --out "${INPUT_CERT_PATH}" > /dev/null
   fi
 }
 
@@ -125,7 +125,7 @@ execute_download() {
     --output json \
     --no-color \
     cert download "${INPUT_CERT_ID}" \
-    -out "${INPUT_CERT_PATH}"
+    --out "${INPUT_CERT_PATH}"
 }
 
 # ── 5. Parse output and set Action outputs ───────────────────────