OCI-IMAGE-VERIFICATION(1)

💖 OCI-IMAGE-VERIFICATION(1) 💖

okay so bestie, before anything else: this is the OCI-IMAGE-VERIFICATION(1) page, from the User Commands section of the manual. It's a little command-line bestie for verifying Sigstore OCI images, and honestly? she's doing the most, in a good way. Pull up a chair. 🫶

---

🌸 NAME 🌸

oci-image-verification — Sigstore OCI image verification ✨

---

🦋 DESCRIPTION 🦋

So this is the usage screen for /build/sigstore-go-NaHzIh/sigstore-go-1.3.0/debian/tmp/usr/bin/oci-image-verification. That's the binary. That exact path, no cap, character for character, because we copy paths verbatim in this house. 💅

Usage of /build/sigstore-go-NaHzIh/sigstore-go-1.3.0/debian/tmp/usr/bin/oci-image-verification:

And then here's the whole flag roster, every single one, because we do not skip flags. Skipping flags is not giving main character energy. 👑

• -artifact string — the path to the artifact you wanna verify. 🔍
• -artifact-digest string — the digest of the artifact you're verifying, in hex-encoded form. 🔢
• -artifact-digest-algorithm string — which digest algorithm to use. Default is "sha256".
• -expectedIssuer string — the expected OIDC issuer for the signing certificate. 🪪
• -expectedIssuerRegex string — the expected OIDC issuer for the signing certificate. (yep, same sentence as above — that's literally what the page says, I'm not out here inventing lore 🌈)
• -expectedSAN string — the expected identity inside the signing certificate's SAN extension.
• -expectedSANRegex string — the expected identity inside the signing certificate's SAN extension. (again, twin energy — identical description, fr fr 🫠)
• -ignore-sct — ignore SCT verification. Which means: do not check that a certificate contains an embedded SCT, aka a proof of inclusion in a certificate transparency log. 🚫📜
• -minBundleVersion string — the minimum acceptable bundle version, like '0.1' for example.
• -ociImage string — the OCI image to verify. 🖼️
• -publicKey string — the path to a trusted public key. 🔑
• -requireTimestamp — require either an RFC3161 signed timestamp or a log entry integrated timestamp. Default is true. ⏰
• -requireTlog — require an Artifact Transparency log entry (Rekor). Default is true. 🌲
• -trustedrootJSONpath string — path to the trustedroot JSON file. Default is "examples/trusted-root-public-good.json".
• -tufDirectory string — the directory where TUF metadata gets stored. Default is "tufdata". 📁
• -tufRootURL string — the URL of the TUF root that contains the trusted root JSON file. 🌐

bestie heads up: both -requireTimestamp and -requireTlog default to true, so if you were planning on doing the bare minimum, the command is gonna vibe-check you first. 😭

---

🎀 that's the whole page 🎀

No hidden sections, no secret flags, no extra crumbs. What you see listed above is the entire menu. 🍓

And for the little sign-off moment the footer deserves: this page belongs to oci-image-verification, version 1.3.0-1, and it's dated August 2026. Sending you off with that, periodt. 💖✨🦋🌸💅🫶