`maqpna verify bundle`

Verify an air-gap bundle's checksums, signature and images

Operate-o json | yaml

Synopsis#

maqpna verify bundle DIR [--require-signature] [--key cosign.pub | --certificate-identity[-regexp] ...] [--trusted-root F]

Description#

From the help of maqpna verify:

Exit status 3 when any check fails. Defaults trust the MAQPNA release workflows: images and the chart signed by the MAQPNA release.yml at the tag, binaries by the MAQPNA maqpna-signed-release.yml.

Flags#

Flag	Type	Description	Default
`--certificate-identity`	string	keyless SHA256SUMS.cosign.bundle: exact signer identity	none
`--certificate-identity-regexp`	string	keyless: signer identity regexp (default: the MAQPNA release workflows)	none
`--certificate-oidc-issuer`	string	keyless: OIDC issuer (default https://token.actions.githubusercontent.com)	none
`--key`	string	cosign public key for SHA256SUMS.sig (default DIR/cosign.pub)	none
`--no-image-check`	switch	do not require all 11 MAQPNA images in images.txt	none
`--require-signature`	switch	fail when the signature is missing or cannot be verified	none
`--trusted-root`	string	keyless: Sigstore trusted_root.json for offline verification	none

The global flags (--context, -o, --no-color, ...) work with every command.

What happens when you run it#

Prints a table by default; -o json or -o yaml print the data, and --jq EXPR filters the JSON.

Exit codes#

Code	Meaning
`0`	success
`1`	error (the message says what failed, with a hint when there is one)
`2`	usage error: unknown flag, missing argument or bad value; the synopsis is printed
`3`	a check failed, a change is blocked, or a result did not match (tamper, policy mismatch) (not used by this command)

Terminal demo#

maqpna verify bundle --help.cast

This command downloads signatures, images or charts from the network, so the recording shows its help.

maqpna verify bundle