`maqpna verify release`

Verify every image, the chart and the binaries of a release

Operate-o json | yaml

Synopsis#

maqpna verify release VERSION [--registry R] [--sbom] [--binaries DIR] [--no-images] [--no-chart]

Description#

From the help of maqpna verify:

Exit status 3 when any check fails. Defaults trust the MAQPNA release workflows: images and the chart signed by the MAQPNA release.yml at the tag, binaries by the MAQPNA maqpna-signed-release.yml.

Flags#

Flag	Type	Description	Default
`--binaries`	string	directory of downloaded release binaries (+ .sigstore.json, checksums.txt) to verify	none
`--no-chart`	switch	skip the Helm chart	none
`--no-images`	switch	skip the images	none
`--registry`	string	image registry prefix	`<release-registry>`
`--sbom`	switch	also verify the SBOM attestation of every image	none

The global flags (--context, -o, --no-color, ...) work with every command.

Examples#

$ maqpna verify release v1.4.0

What happens when you run it#

Prints a table by default; -o json or -o yaml print the data, and --jq EXPR filters the JSON.

Exit codes#

Code	Meaning
`0`	success
`1`	error (the message says what failed, with a hint when there is one)
`2`	usage error: unknown flag, missing argument or bad value; the synopsis is printed
`3`	a check failed, a change is blocked, or a result did not match (tamper, policy mismatch) (not used by this command)

Terminal demo#

maqpna verify release --help.cast

This command downloads signatures, images or charts from the network, so the recording shows its help.

maqpna verify release