Parameter values starting with '-' cannot be passed — PEM-bodied params (cert/key upload) are unusable; please add file input

[onionllc]

Summary

Parameter values that begin with - are rejected by the CLI's argument parser, and there is no file/stdin input mechanism for parameter values. Combined, this makes any API whose parameter is a PEM body — certificate/key upload actions such as alb UploadCertificate (--PublicKey / --PrivateKey) — impossible to call through the CLI. The only remaining path for these actions is the web console.

Reproduction

Tested on volcengine-cli 1.0.49 and 1.0.52 (macOS, arm64).

# throwaway self-signed pair
openssl req -x509 -newkey rsa:2048 -nodes -keyout t.key -out t.crt -days 1 -subj /CN=repro

ve alb UploadCertificate \
  --CertificateName repro-test \
  --CertificateType Server \
  --PublicKey "$(cat t.crt)" \
  --PrivateKey "$(cat t.key)"

Result — the parser rejects the value because PEM always starts with -----BEGIN:

-----BEGIN CERTIFICATE----- ... is not supported, supported fixed flags: ---profile, ---region, ---endpoint

The --Key=value form is not accepted either:

--CertificateName=x must set value

Why no quoting workaround exists

It is a two-layer catch-22:

1. Any value starting with - is rejected by the argv parser, and PEM bodies always start with -----BEGIN.
2. Padding the value to get past the parser (e.g. --PublicKey "$(printf '\n%s' "$(cat t.crt)")") makes the request reach the API, but the server then rejects it with InvalidPublicKey.Malformed (400) because the body must start exactly with -----BEGIN.

So there is no combination of shell quoting that can deliver a valid PEM through the CLI.

Suggested fixes (any one of these would resolve it)

1. File input for parameter values (most useful): support --PublicKey file://t.crt or --PublicKey @t.crt, reading the value from the file — similar to aws-cli's file:// convention. This also avoids putting private-key material into shell history / process argv.
2. Accept --Key=value syntax, so a leading-- value is unambiguous.
3. Treat the token following a recognized --ParameterName as its value even when it begins with - (only free-standing tokens need the leading-dash check).

Related quality-of-life notes for cert uploads

While validating with the console as a workaround, two server-side strictness behaviors also make CLI usage of these actions harder than necessary; if the CLI gains file input it may be worth normalizing these client-side (or at least documenting them):

• PEM lines with trailing whitespace are rejected as Malformed (some CA downloads include a padded header line).
• PKCS#8 private keys (-----BEGIN PRIVATE KEY-----) are rejected; only the traditional formats (BEGIN RSA PRIVATE KEY / BEGIN EC PRIVATE KEY) are accepted, so keys from most modern tooling need an openssl rsa -traditional conversion first.

Thanks for maintaining the CLI — happy to provide more detail or test a patch.

[volc-sdk-team]

@onionllc ：

Thank you for the detailed reproduction steps and suggestions. We have confirmed this is a CLI argument parsing issue: values beginning with - are incorrectly interpreted as new flags, preventing PEM certificates and private keys from being passed correctly. We plan to fix the parser and add regression tests, with the fix expected within the next two releases. We will post an update here once it is available. Thank you for your feedback and patience.

---

感谢你提供详细的复现步骤和建议。我们已经确认这是 CLI 参数解析问题：以 - 开头的参数值会被错误识别为新的参数，导致 PEM 证书及私钥无法正常传入。我们将修复解析逻辑并补充回归测试，预计在接下来的两个版本内发布修复。发布后会在此 Issue 中同步进展，感谢你的反馈和耐心等待。