=head1 MODES OF OPERATION

The modes of operation described in this section are mutually
exclusive.  In other words, only one mode may be specified per
invocation.

=over 5

=item B<{-s|--sign-payload}> B<{-k|--key-file}> B<key> B<{payload|-}> B<[payload ...]>

Use B<key> to digitally sign the specified B<payload>.  The B<key>, as
specified by the B<--key-file> argument, must be a PEM-encoded DSA or
RSA key.  For each B<payload> signed, a corresponding signature file
will be created.  Signature files have the same basename as the
original B<payload>, and they end with a '.sig' suffix.  The format of
a signature file is a single line of base64-encoded data.

To allow for automated or batch signing, B<WebJob-DsvTool> will honor
the DSV_PASSPHRASE environment variable so long as it's less than
DSV_MAX_PASSPHRASE_LENGTH bytes long -- this length is defined in
dsv.h.  While this mechanism is supported, its use in production
environments is not recommended because it increases the risk of
passphrase exposure.

=item B<{-c|--check-signature}> B<{-f|--cert-file}> B<cert> B<signature> B<[signature ...]>

Use the specified B<cert> to verify each B<signature>.  The B<cert>,
as specified by the B<--cert-file> argument, must be a PEM-encoded
certificate.  Note that signature files are expected to have the same
basename as the corresponding payload file, and they must end with a
'.sig' suffix.

=item B<{-c|--check-signature}> B<{-t|--cert-tree}> B<tree> B<signature> B<[signature ...]>

Use all certificates stored in the certificate B<tree> to verify each
B<signature>.  The files stored in the certificate B<tree> must be
PEM-encoded certificates -- invalid and non-PEM-encoded files are
silently ignored.  Each certificate in the certificate B<tree> is
used, in turn, to verify the specified B<signature>.  The verification
process does not stop until a match is found or all certificates have
been tried.  Note that B<WebJob-DsvTool> will not search for
certificates in sub-directories of the specified B<tree>.  Note that
signature files are expected to have the same basename as the
corresponding payload file, and they must end with a '.sig' suffix.

=item B<{-g|--generate-key}> B<{-b|--bits}> B<bits> B<{-t|--type}> B<type>

Generate a PEM-encoded private key having the specified number of
B<bits>.  The B<bits> must be a multiple of 256 and in the range
[1024-4096].  The B<type> argument must be 'DSA' or 'RSA'.  The new
key will be written to stdout.  If the key needs to be protected with
a passphrase, one can be added with openssl(1).

=item B<{-p|--generate-password}> B<[{-C|--character-class} class]> B<[{-c|--character-set} set]> B<[{-l|--length} length]>

Generate a pseudo random password using the default character set
(alnum) or one specified on the command line.  The password B<length>,
if specified, must be in the range [1-1048576] bytes.  Otherwise, the
default length is 8 bytes.  The character B<set>, if specified,
becomes the literal set of characters from which passwords may be
generated.  The character B<class>, if specified, allows the user to
select one of the following character sets:

    char95  - [0-9A-Za-z] + specials
    char92  - [0-9A-Za-z] + specials - (space and double/single/back quotes)
    alnum   - [0-9A-Za-z]
    alpha   - [A-Za-z]
    lower   - [a-z]
    upper   - [A-Z]
    base16  - [0-9a-f] (a.k.a. hex)
    base10  - [0-9] (a.k.a. digit)
    base8   - [0-7] (a.k.a. octal)
    base2   - [0-1] (a.k.a. binary)

=item B<{-v|--version}>

Display version information and exit.

=back

