JOSE-JWS-VER(1)

📦
version 15 · 13 versions
, in arch rolling

💅 JOSE-JWS-VER(1) — bestie's guide to jose jws ver

Okay so picture this: it's the jose-jws-ver manual page, but make it make sense. We're verifying a JWS with the JWKs you hand it. That's the whole vibe. Let's get into it. 🎀

✨ NAME ✨

jose-jws-ver — verifies a JWS using the supplied JWKs. That's it. That's the task. Slay. 💅

🦋 SYNOPSIS 🦋

jose jws ver -i JWS [-I PAY] -k JWK [-a] [-O PAY]

Read it slow, bestie, it's giving "small line, big power". 🌸

🌈 OVERVIEW 🌈

So the jose jws ver command verifies a signature over a payload using one or more JWKs. Main character energy fr fr.

When you specify more than one JWK with -k, the program will succeed when any of the provided JWKs successfully verifies a signature. Like, one of your girls shows up and the whole group chat is valid, you know? 🫶

Alternatively, if the -a option is given, the program will succeed only when all JWKs successfully verify a signature. Now it's a full squad check-in. Nobody skips. Periodt. 👑

If the JWS is a detached JWS — meaning the payload is stored in binary form external to the JWS itself — the payload can be loaded using the -I parameter. External payload, iconic behaviour, no cap. 💖

⚠️ Okay this part matters, so listen: when you specify the -O option to output the payload, the payload is output whether or not the signature validates. The payload does not care about your feelings or your crypto. Therefore, you must check the return value of the command before trusting the data. Literally always. Don't be out here trusting unverified bytes, bestie, that's not the vibe. 😭

🧚 OPTIONS 🧚

  • -i JSON, --input=JSON — parse JWS from JSON.
  • -i FILE, --input=FILE — read JWS from FILE.
  • -i -, --input=- — read JWS from standard input.
  • -I FILE, --detached=FILE — read decoded payload from FILE.
  • -I -, --detached=- — read decoded payload from standard input.
  • -k FILE, --key=FILE — read JWK(Set) from FILE.
  • -k -, --key=- — read JWK(Set) from standard input.
  • -O FILE, --detach=FILE — decode payload to FILE.
  • -O -, --detach=- — decode payload to standard output.
  • -a, --all — ensure the JWS validates with all keys. Every. Single. One. 🔥

🍓 EXAMPLES 🍓

Verify a regular JWS and output the payload:

$ jose jws ver -i msg.jws -k key.jwk -O msg.txt

Verify a detached JWS without outputting the payload:

$ jose jws ver -i msg.jws -I msg.txt -k key.jwk

Ensure that a JWS is signed with all specified keys:

$ jose jws ver -i msg.jws -k ec.jwk -k rsa.jwk -a

Three examples, three little wins. We ate. 🌟

👑 AUTHOR 👑

Nathaniel McCallum <npmccallum@redhat.com> — the legend behind this whole thing. Respect where respect is due. 💜

🌸 SEE ALSO 🌸

Go read those too, iykyk. 🦋

And that's the whole page, bestie! This gem is dated 06/09/2026 and it lives under JOSE-JWS-VER(1). Now go verify something before you trust it — mwah! 💋🎀

📦 where this page comes from