feat: Enhanced the sealed Secret flg

[Rohit-Singh43-1]

Description

Enhanced the sealed Secret Flag, To support multiple files creation for output.

When --out is provided (e.g. --out sealed_secret.txt), three separate files are created:

File	Contents
sealed_secret_SealedValue.txt	Sealed secret value (for use in the contract)
sealed_secret_DecryptionKey.txt	RSA private key for decryption — keep this secure
sealed_secret_VerificationKey.txt	RSA public key for signature verification

Related Issue

Fixes #

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Code refactor (no functional changes)
• CI/CD or build changes

Target Platform

• HPVS (IBM Hyper Protect Virtual Servers for VPC)
• CCRT (IBM Confidential Computing Container Runtime)
• CCRV (IBM Confidential Computing Container Runtime for Red Hat Virtualization Solutions)
• CCCO (IBM Confidential Computing Containers for Red Hat OpenShift Container Platform)
• All platforms
• Not platform-specific

Testing

• make test passes
• make fmt applied (no formatting changes needed)
• New tests added for new functionality (if applicable)

Checklist

• My code follows the project's coding standards
• I have performed a self-review of my code
• I have added/updated GoDoc comments for public functions
• I have updated documentation (README, docs/README.md) if needed
• All new and existing tests pass (make test)
• I have verified there are no breaking changes (or documented them above)

[vikas-sharma24]

@Rohit-Singh43-1 could you add some examples of the updated command?
Also it now generates three output files. Can we introduce a separate flag to control this behavior?

[vikas-sharma24]

just a suggestion can we go with some other format (example json).
Is this is easy to read if we print all 3 values?

[Rohit-Singh43-1]

`./contract-cli-s390x --help
Contract CLI automates contract generation and management for IBM Confidential Computing services.

Supports:

• IBM Confidential Computing Container Runtime
• IBM Confidential Computing Container Runtime for Red Hat Virtualization Solutions
• IBM Confidential Computing Containers for Red Hat OpenShift Container Platform

Documentation: https://ibm-hyper-protect.github.io/contract-cli/

Usage:
contract-cli [flags]
contract-cli [command]

Available Commands:
base64 Encode input as Base64
base64-tgz Create Base64 tar archive of container configurations
contract-template Generate a contract template
decrypt-attestation Decrypt encrypted attestation records
download-certificate Download encryption certificates
encrypt Generate signed and encrypted contract
encrypt-string Encrypt string in IBM Confidential Computing format
get-certificate Extract specific certificate version from download output
help Help about any command
image Get IBM Confidential Computing Container Runtime image details from IBM Cloud
initdata Gzip and Encoded initdata annotation
list-encryptioncert-versions List available encryption certificate versions
sealed-secret Generate sealed secret for CCCO
sign-contract Sign an encrypted contract
validate-contract Validate contract schema
validate-encryption-certificate Validate encryption certificate
validate-network Validate network configuration schema

Flags:
-h, --help help for contract-cli
-v, --version version for contract-cli

Use "contract-cli [command] --help" for more information about a command.
[root@mystack1 test_sealed]# ./contract-cli-s390x sealed-secret --help
Usage:
contract-cli sealed-secret [flags]

Mandatory Flags:
--in Secret for sealing (provide as string or file path, use '-' for standard input)
--type Type of secret: 'env' for env section of contract or 'workload' for workload section of contract

Optional Flags:
--encryptionkey Path to RSA private key for encryption (optional, generates new key if not provided)
--help help for sealed-secret
--out Path to save sealed secret output (optional, prints to stdout if not specified)
--signingkey Path to RSA private key for signing (optional, generates new key if not provided)
./contract-cli-s390x sealed-secret --in rohit --type env
{
"sealed_secret": "sealed.eyJhbGciOiJSUzUxMiIsImtpZCI6ImVudl92ZXJpZnkifQ.eyJlbmNyeXB0ZWRfZGF0YSI6IjYyMmtRZUJTOXVORGFZWUZGUVFyQ0dQcVFpMWkiLCJlbmNyeXB0ZWRfa2V5IjoibkRsQzRpR3NHNXFjR21CWWVVY2RlL3FUWjJaemN6dnZGVHlKMVkrVnVyeTB5R0pPZk80dEpDUjJjdUVLNzNhQWVBMGNPTkZhZytGZllhUGdaVitmSlBKZXBvakQ3UEhXaVBDK1dhUXFCUDJwTjNPZEd1Q3pyK09DNStWVGQ1MnA4dHhPc1RZaVhnNE5oSVhsQXgyN09OZ3FtMDhyTUxTcXA5QnZlVi9hbEQ5VHhrZmk4ekRRc1MzUHVYbU14SGdrOERXWEVmSHo2ZjJCWTNXTUNJSU5UbG9pVzZYWUpLbUJBL3E3MHJOcVA0TDFmaFJuMlJYbEpySUhCVUVQbFFyRkpvcHZlY3ROdjNJSnd6bHdsZnBJTktvOE5yZm1yVDNIWUdNYW00NXk1ZHR5ZGw4UmxET1IrUGYzNnJyQ1Jkb3BVUFRjcVBPaE5kVjRmVksrVGpKdHdBPT0iLCJpdiI6IjM1L1ZmZlBiNjNncUtkZmsiLCJrZXlfaWQiOiJlbnZfZGVjcnlwdCIsInByb3ZpZGVyIjoiaWJtLWhwY3ItY29udHJhY3QiLCJ0eXBlIjoia21zIiwidmVyc2lvbiI6IjAuMS4wIiwid3JhcF90eXBlIjoiQTI1NkdDTSJ9.HV4X0eqvFJc0WR5FzoFluTQjoEvJ2iDg6G9QAINJfciOT0K3Zl5lo6Ur9wGc6lyA-idmpbpBx2HaQPRWL71R3X_257Ik_Y3QzTNftI6my7apB6HE8ictPBFKhxM0_s0XoiPPDZW9PuhjoW_IuTJhHf_kG2josYmg01b9d-qg8lEP_EdeCx5EjnW2lPHl6fXtZ-VCEtqX5Z_ARAlqDaT1532ytDM6LdmRtak004TxhxSb8tunGqaWEnZbdPbxEJSr4e_pxuxNoizR38YfK-d7uTJHRqxDPak-N8cjojIDIq9BjsjW_EeSWtyTd6RIjLxanMyEswrkyfwcb3HKUxDgKA",
"decryption_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEAwJddCFb3veNG790pXjyCJWsgR/FE2Xsbqgza3XCFaFlPqZi/\na5HChnuetr7bXk6z337C/b+Pp/RBBaDlrrttF2knyz/D4WsRmYXCyCGyTLxg5Wrh\nZgONSjO/jkyvYAfl2AoRQebiZTXsNHIyuZtW7yjky0ByaEnee6V820oq376OqiPx\nDU1tPs5UUVgXpKwe8J589nk3oaMWetej1zx5NbCB+/JdIPDS+3gBaILleD3iv9bG\nNYCCbdYsex+mC2FUtK8WqkCKWUcQcCewPSNG0HL+UsJaTwXUOYDcjds2FMQvfB8Q\nD2V/i0DExhmedIndy5bKwHpQ4/YAZEJkrXeM4QIDAQABAoIBAAFKin7BsYHCBjHZ\nvFsjwfYdAp+E2jKwkPoKAcYiCNzvG1n+WosutByJc+ITA769PZa6H3XKzNxiBnUS\nk/Og0U2KwI/r5qTqXjj2pPyJQEwkJ6ymE6qGy9HTaL18HWFiECwLfjvgP8SQsNuV\np+onZNTv49/Kd/Hjy+RtkrmYJNMw7YDbj7iBxvYenOGd2O7TeCGkk7NOr3BZsMVP\nAfGZvpDCsfCyw7X3WBzYIZ0AWZkUQdI+7mh5pCGShMV/ZuOX70PBo7DbGXNDHn+F\nwKEJZr1H6J8DpH5N9l40w9Eiy5k94gTqQjxqs0q+v6vTN1O0TDPffwMpwN7sEOZO\nYUsVxYkCgYEAzg0PLHPDfAvbLEVZ3kQo+Gy3qBmyokdclXZdNQgfZziHMd8HPTag\nClYEEmwf3IfJYP+8JygDbbhYvJpyXsrl0FhjNIWIAQKEuHNTofRH2AxskaX2jvsQ\naEDeaTjAa9a7Ju9dEF+zpwFfyluLW3e5weJt6fkzMJEwP1kTWtt+ZAkCgYEA70cH\nwigR3N3XHbeFlm0rRL9bFno6wCgFCAvRUYp4YEdxTGNMoAkp60bZaVZIB5jHTPJI\najtqhRuoNPK18DjK1ul/jRR0xW6bcjJucQUuAexcIWm2A3A+JucBQz/Fzjn3sX06\nhLf2L2J0JR/4SZa0V4hTHSKZL86Md6HHx33jiBkCgYEAiQE17aCrgnd/q9gRATDg\n7Q2csDEmDbDVZqvlHbXg64kym35oGdOQZk77NiSeqsu+orhoKsD4RqQknIM1OMJA\nPGAI1otS+xjplptYKH98pbLdHZr0be2R4z/+oogRqaKFnkXZ42E+2vSW9L4Z0x+w\na7Ja0w/XcZuYMQbRT8BSMcECgYEA6EoVrxiFVt0KhC/xATsUQVZf0G9y768qS0hl\nufpqqFVTGWxhLBAZYO5UDF4V6UIZYYroYDE0VOqnnldt5zrLOF5QVJ7iSfT59aAd\n9ZyosHdMbaeZarchr1SdtjKIDo/Z9bX0BHovBotW49+og5BJnZyby3IWMwIa/dzR\n/MorBKkCgYB4WD/XRh/LJxOuDWzmmeVuhlxdFEC/9sB/PgModrrSZ8zHqNZGKpYK\n0TCIjX1vCsDEeLe/Wbo9DPHfqgc6oHuwng2yuFddK8zGVbO1z0r5cNVgzvq0mxAK\n1cU6hmrFYixUqHUkvVP6oV4D75DbqnNNar/oElVj+A//QAUyESK+HA==\n-----END RSA PRIVATE KEY-----\n",
"verification_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqgHSKYYXOxNWejJVTaoW\nG+3xb3Sh+xbQzamR+8O+hGLoZnxVIjAKYxsUl+inSW1Qj6uwKCIeVDdeP2q1P9ur\nUKoEt5JRdh8Lm4NDCV5aVqEPT3z2Q7tecOSY3nB0LtWVqDBXb2ycPV0LWMT9dhJE\nBeMvO01v6UWZUVcE02ukY+C4AHE800UGSDN3uu0fUmRlEqcOQRA4BpGPoiiMDkeA\nZnHs36T0e3SQo6IG/1k9yxQJvu1UIsayJf17+4egHjoXxOpzRCzrNySMQ4mH1cKx\n2cj4QkyJOSZW9vg0U9DSqKweObfjHROlfPoHDoOZsW4gN0UkBT6GuJ5AzaH/mxFt\nyQIDAQAB\n-----END PUBLIC KEY-----\n"
}`