PVATTEST-VERIFY(1)

💅 PVATTEST-VERIFY(1) — the attestation manual, bestie edition ✨

okay so this is a page from the Attestation Manual, and it's about pvattest-verify. buckle up 🎀

---

🌸 NAME 🌸

pvattest-verify — verify an attestation response. that's it, that's the vibe. it checks whether a measurement you made earlier is actually what you think it is 👑

---

✨ SYNOPSIS ✨

pvattest verify [OPTIONS] --input <FILE> --hdr <FILE> --arpk <FILE>

---

🦋 DESCRIPTION 🦋

so the whole point: you verify that an attestation measurement of an IBM Secure Execution guest that was generated earlier is, like, actually as expected. that's the entire job. 💅

only verify attestation requests in a trusted environment — think your own workstation, not some sketchy shared box. this is not a drill, it's literally in the manual 🫶

the input has to contain the response exactly as it was produced by pvattest perform. the protection key has to be the same one that was used to create the request via pvattest create — same key, no substitutions. and then: shred the protection key after the verification. like, actually shred it. 🗑️✨

the header has to be the IBM Secure Execution header of the image that was attested during pvattest perform.

now the important part, the vibe check of this whole command: verify solely verifies that the Attestation measurement is correct. that's it. it does not check for the content of additional data or user data. if you want policy checks after you verified the Attestation measurement, go see pvattest check. iykyk 😌

---

🎀 OPTIONS 🎀

• -i, --input <FILE> — tells it which attestation response to verify. the file in question, the main character.
• -o, --output <FILE> — where the verification result gets written. your output slot, your rules 💖
• --hdr <FILE> — the header of the guest image. can be an IBM Secure Execution image created by genprotimg, or an extracted IBM Secure Execution header. heads up: the header must start at a page boundary. not optional, fr fr.
• -a, --arpk <FILE> — use FILE as the protection key to decrypt the request. 🔐 do not publish this key, otherwise your attestation is compromised — compromised!! and delete this key after verification. (shredding again. we love consistency.)
• --format <FORMAT> — defines the output format. default is 'yaml'. possible values:
  • yaml: use yaml format. that's the only one listed, and it ate 💅
• -u, --user-data <FILE> — write the user data to FILE if there is any. so: if the response contains any user data, it gets written to FILE. the user-data is part of the attestation measurement, which means if it does get written to FILE, then that user-data was part of the measurement and was verified ✅. if the response contains no user-data, it emits a warning. (lowkey rude but okay 🙈)
• -h, --help — print help. note the parenthetical: see a summary with -h. iconic.

---

💀 EXIT STATUS 💀

• 0 - Attestation Verified — attestation measurement verified successfully. the measured guest is in Secure Execution mode. slay!! 🎉👑
• 1 - Program Error — something went wrong during the local calculation or the receiving of the measurement value. refer to the error message. not me crying 😭
• 2 - Attestation NOT Verified — the attestation measurement calculation does not match the received value. the measured guest is very likely not in Secure Execution mode. big yikes. 🚩

---

🌈 EXAMPLES 🌈

to verify a measurement in measurement.bin with the protection key arp.kep and SE-guest header se_guest.hdr — yes, the prose says measurement.bin and arp.kep while the command says attresp.bin and arp.key, that's just how the page reads, copy the command bestie 🫶 — you run:

$ pvattest verify --input attresp.bin --arpk arp.key --hdr se_guest.hdr

if the verification was successful, the program exits with zero ✨. if the verification failed, it exits with 2 and prints this to stderr:

ERROR: Attestation measurement verification failed:
       Calculated and received attestation measurement are not the same.

---

🧚 SEE ALSO 🧚

• pvattest(1) — go read the main one, it's giving main character energy 💜

---

and that's the whole page!! brought to you by s390-tools, dated 2026-08-11 — go verify responsibly, shred your keys, and don't publish your arpk, ily 🎀⭐