SIGSUM-VERIFY(1)

📦
version 0.14.1 · 6 versions
, in ubuntu stonking

💖 SIGSUM-VERIFY(1) — the manual page, bestie edition 💖

User Commands · sigsum-verify · enforce public logging

okay so you found the sigsum-verify man page and honestly? you're about to have the best time. this is a user command, it lives in section 1, and its whole personality is enforce public logging. let's get into it 🫶

✨ NAME ✨

sigsum-verify — enforce public logging

like. that's the job. it enforces it. no notes 👑

🌸 SYNOPSIS 🌸

sigsum-verify [-v] [--help] [-k key-file] [-P policy-name] [-p policy-file] [--raw-hash] proof-file < input

🦋 DESCRIPTION 🦋

So what this actually does: it verifies that a message's signed checksum is logged for a given trust policy. that's the vibe check. if the logging happened like it was supposed to, you're golden ✨

and the message you're verifying? it comes in on stdin. not as an argument, bestie — it's read from standard input. the < input in the synopsis is not decorative, it's the whole point, periodt 💅

🎀 OPTIONS 🎀

  • --help — shows you the usage message and then bounces. exit, stage left 💫
  • -k, --key=key-file — your submitter public keys, one per line in OpenSSH format. and yeah — this one is required 🔥 (fr fr, don't skip it)
  • -P, --named-policy=policy-name — use a <concept>named trust policy</concept> — a name that defines the logs, the witnesses, and a quorum rule 🫶
  • -p, --policy=policy-file — point at a <concept>trust policy file</concept> instead, which also defines logs, witnesses, and a quorum rule 🌸
  • --raw-hash — for when your input has already been hashed, and it's formatted as 32 octets or as a hex string. it's giving "i did the work already" 💅
  • -v, --version — shows the software version and exits. iconic info dump ⭐

💀 RETURN CODES 💀

A non-zero return code means failure. so like, zero = slay, non-zero = something went wrong 😭 that's it, that's the rule.

📬 CONTACT 📬

Wanna talk to a human? send an email to the sigsum-general mailing list at sigsum-general@lists.sigsum.org. you can also reach out in room #sigsum at OFTC.net and matrix.org. come hang out, we don't bite 🫶

🌈 ENVIRONMENT 🌈

The behavior of the sigsum tools is affected by the following environment variables:

  • SIGSUM_POLICY_DIR — if you set this, it decides where the sigsum tools go looking for named policy files (*.sigsum-policy). lowkey a glow-up for your workflow ✨

🍓 FILES 🍓

  • /etc/sigsum/policy — this directory is the default location for named policy files (*.sigsum-policy) — but only when SIGSUM_POLICY_DIR is not set. so if you set that env var, this is not the one, bestie 🙈

🐛 REPORTING BUGS 🐛

found a bug? use the issue tracker at https://git.glasklar.is/sigsum/core/sigsum-go/-/issues. and if you don't have a GitLab account (no shade, valid), send an email to sigsum-core-sigsum-go-issues@incoming.glasklar.is and wait for a maintainer to make the issue public. patience is a vibe 💜

👑 SEE ALSO 👑

go read them, they're all part of the same friend group 🌸

k bye bestie, that's the whole page!! this gorgeous little number is sigsum-verify version 0.14.1-2, dated June 2026 🎀 mwah, take care of her 💖

📦 where this page comes from