skopeo-standalone-verify(1)

1skopeo-standalone-verify(1)()                    skopeo-standalone-verify(1)()
2
3
4

NAME

6       skopeo-standalone-verify - Verify an image signature.
7
8

SYNOPSIS

10       skopeo  standalone-verify  manifest  docker-reference  key-fingerprints
11       signature
12
13

DESCRIPTION

15       Verify a signature using local files; the digest  will  be  printed  on
16       success.  This is primarily a debugging tool, useful for special cases,
17       and usually should not be a part of your normal  operational  workflow.
18       Additionally,  consider  configuring  a  signature  verification policy
19       file, as per containers-policy.json(5).
20
21
22       manifest Path to a file containing the image manifest
23
24
25       docker-reference A docker reference expected to identify the  image  in
26       the signature
27
28
29       key-fingerprints  Identities of trusted signing keys (comma separated),
30       or "any" to trust any known key when using a public key file
31
32
33       signature Path to signature file
34
35
36       Note: If you do use this, make sure that the image can not  be  changed
37       at the source location between the times of its verification and use.
38
39

OPTIONS

41       See also skopeo(1) for options placed before the subcommand name.
42
43
44       --help, -h
45
46
47       Print usage statement
48
49
50       --public-key-file public key file
51
52
53       File  containing  the  public keys to use when verifying signatures. If
54       this is not specified, keys from the GPG homedir are used.
55
56

EXAMPLES

58       $ skopeo standalone-verify busybox-manifest.json registry.example.com/example/busybox 1D8230F6CDB6A06716E414C1DB72F2188BB46CC8  busybox.signature
59       Signature verified, digest sha256:20bf21ed457b390829cdbeec8795a7bea1626991fda603e0d01b4e7f60427e55
60
61
62

NOTES

64       This command is intended for use with local signatures e.g.  OpenPGP  (
65       other  signature  formats may be added in the future ), as per contain‐
66       ers-signature(5). Furthermore, this command does not interact with  the
67       artifacts  generated  by  Docker Content Trust (DCT). For more informa‐
68       tion, please see  containers-signature(5)  ⟨https://github.com/contain‐
69       ers/image/blob/main/docs/containers-signature.5.md⟩.
70
71

AUTHORS

77       Antonio  Murdaca runcom@redhat.com ⟨mailto:runcom@redhat.com⟩, Miloslav
78       Trmac mitr@redhat.com ⟨mailto:mitr@redhat.com⟩, Jhon Honce  jhonce@red‐
79       hat.com ⟨mailto:jhonce@redhat.com⟩
80
81
82
83                                                 skopeo-standalone-verify(1)()