SIGSTORE-GO-VERIFICATION(1)

💖 SIGSTORE-GO-VERIFICATION(1) 💖

okay bestie so real quick — this whole page is the manual for sigstore-go-verification, a teeny tiny user command that lives in section 1 of your man pages. it's basically the lil verification bouncer for sigstore-go and it is SO good at checking that your artifacts are who they say they are. no cap. 🫶

---

✨ NAME ✨

sigstore-go-verification — the Sigstore verification tool. that's it, that's the name, and honestly? iconic. 💅

---

🎀 DESCRIPTION 🎀

so the way this works is, this is the usage info for the binary chilling at:

/build/sigstore-go-NaHzIh/sigstore-go-1.3.0/debian/tmp/usr/bin/sigstore-go-verification

and here's every single flag it takes, fr fr. don't skip any of them, they all matter 👑

• -artifact string — path to the artifact you wanna verify 🦋
• -artifact-digest string — the hex-encoded digest of the artifact you're verifying. yes, hex-encoded, don't come at me with base64. 💜
• -artifact-digest-algorithm string — which digest algorithm to use (default "sha256") ✨
• -expectedIssuer string — the expected OIDC issuer for the signing certificate
• -expectedIssuerRegex string — also the expected OIDC issuer for the signing certificate (yes it's a regex version, they're twinning 💖)
• -expectedSAN string — the expected identity in the signing certificate's SAN extension
• -expectedSANRegex string — the expected identity in the signing certificate's SAN extension, but make it regex 🧚
• -minBundleVersion string — the minimum acceptable bundle version, like for example '0.1'
• -publicKey string — path to your trusted public key 🔑
• -requireCTlog — require a Certificate Transparency log entry (default true) 👑
• -requireTimestamp — require either an RFC3161 signed timestamp or a log entry integrated timestamp (default true) ⏰
• -requireTlog — require an Artifact Transparency log entry (Rekor) (default true) 🌸
• -trustedrootJSONpath string — path to the trustedroot JSON file (default "../trusted-root-public-good.json") 🍓
• -tufRootURL string — URL of the TUF root that contains the trusted root JSON file 🌈
• -tufTrustedRoot string — path to the trusted TUF root.json used to bootstrap trust in the remote TUF repository 🫶

---

lowkey important: -requireCTlog, -requireTimestamp and -requireTlog all default to true, so the vibes are strict by default. you gotta opt out, not in. main character security energy, honestly. 💅

and that's the whole page bestie, you ate it up 💖✨

signing off with the deets: this is sigstore-go-verification version 1.3.0-1, dated August 2026, and it's filed under SIGSTORE-GO-VERIFICATION(1). slay 🎀🦋💜