sigil CLI Reference

Command	Description
sigil validate	Validate a sigil.yaml manifest [default: sigil.yaml]
sigil init	Create a new sigil.yaml manifest
sigil pack	Pack the app per the manifest. Note: the 'exe' installer format is produced only on a Windows pack host — it stamps the payload into the installer runtime via the Win32 resource-update APIs (BeginUpdateResourceW), which have no cross-platform equivalent. On non-Windows hosts 'sigil pack' emits a clear diagnostic and skips the exe format (other formats still pack). Pipeline order: 'sigil pack' MUST run BEFORE 'sigil sign' — stamping resources invalidates any prior Authenticode signature, so sign the finished Setup.exe last. [default: sigil.yaml]
sigil sign	Sign an artifact per the manifest's sign provider. IMPORTANT: run 'sigil sign' AFTER 'sigil pack' — pack stamps the payload/brand/blob into the installer via the Win32 resource-update APIs, and any resource edit invalidates a prior Authenticode signature. Signing must therefore be the LAST step (pack → sign); the installer's verified 'Signed by {publisher}' trust line only appears when the finished Setup.exe verifies at install time. [default: sigil.yaml]

sigil validate

Description:
  Validate a sigil.yaml manifest

Usage:
  sigil validate [<path>] [options]

Arguments:
  <path>  Path to the sigil.yaml manifest [default: sigil.yaml]

Options:
  --format <format>  Output format: text | json [default: text]
  -?, -h, --help     Show help and usage information

sigil init

Description:
  Create a new sigil.yaml manifest

Usage:
  sigil init [options]

Options:
  --non-interactive        Do not prompt; require all inputs as flags
  --template <template>    Template name: minimal | msix-local-sign | azure-signing | full-config [default: minimal]
  --out <out>              Output file path [default: sigil.yaml]
  --force                  Overwrite if the output file already exists
  --app-id <app-id>        Reverse-DNS app id
  --app-name <app-name>    Display name
  --version <version>      SemVer version (e.g. 0.1.0)
  --publisher <publisher>  Publisher display name
  -?, -h, --help           Show help and usage information

sigil pack

Description:
  Pack the app per the manifest. Note: the 'exe' installer format is produced only on a Windows pack host — it stamps the payload into the installer runtime via the Win32 resource-update APIs (BeginUpdateResourceW), which have no cross-platform equivalent. On non-Windows hosts 'sigil pack' emits a clear diagnostic and skips the exe format (other formats still pack). Pipeline order: 'sigil pack' MUST run BEFORE 'sigil sign' — stamping resources invalidates any prior Authenticode signature, so sign the finished Setup.exe last.

Usage:
  sigil pack [<path>] [options]

Arguments:
  <path>  Path to the manifest [default: sigil.yaml]

Options:
  --out <out>                  Output directory [default: ./dist]
  --payload <payload>          Exe payload delivery: embedded | web [default: embedded]
  --package-url <package-url>  HTTPS URL the full package will be hosted at — REQUIRED when --payload web
  -?, -h, --help               Show help and usage information

sigil sign

Description:
  Sign an artifact per the manifest's sign provider. IMPORTANT: run 'sigil sign' AFTER 'sigil pack' — pack stamps the payload/brand/blob into the installer via the Win32 resource-update APIs, and any resource edit invalidates a prior Authenticode signature. Signing must therefore be the LAST step (pack → sign); the installer's verified 'Signed by {publisher}' trust line only appears when the finished Setup.exe verifies at install time.

Usage:
  sigil sign [<path>] [options]

Arguments:
  <path>  Path to manifest [default: sigil.yaml]

Options:
  --artifact <artifact> (REQUIRED)  Artifact file to sign
  -?, -h, --help                    Show help and usage information