`maqpna verify binary`

Verify a binary against its Sigstore bundle and checksums

Operate-o json | yaml

Synopsis#

maqpna verify binary FILE [--bundle FILE.sigstore.json] [--checksums checksums.txt]

Description#

From the help of maqpna verify:

Exit status 3 when any check fails. Defaults trust the MAQPNA release workflows: images and the chart signed by the MAQPNA release.yml at the tag, binaries by the MAQPNA maqpna-signed-release.yml.

Flags#

Flag	Type	Description	Default
`--bundle`	string	sigstore bundle (default FILE.sigstore.json)	none
`--checksums`	string	checksums.txt of the release (SHA-256 check)	none
`--identity`	string	exact signer identity	none
`--identity-regexp`	string	signer identity regexp (default: the MAQPNA maqpna-signed-release.yml)	none
`--issuer`	string	OIDC issuer	none

The global flags (--context, -o, --no-color, ...) work with every command.

Examples#

$ maqpna verify binary ./maqpna --checksums checksums.txt

What happens when you run it#

Prints a table by default; -o json or -o yaml print the data, and --jq EXPR filters the JSON.

Exit codes#

Code	Meaning
`0`	success
`1`	error (the message says what failed, with a hint when there is one)
`2`	usage error: unknown flag, missing argument or bad value; the synopsis is printed
`3`	a check failed, a change is blocked, or a result did not match (tamper, policy mismatch) (not used by this command)

Terminal demo#

maqpna verify binary --help.cast

This command downloads signatures, images or charts from the network, so the recording shows its help.

maqpna verify binary