SKOPEO-STANDALONE-VERIFY(1)

💖 skopeo-standalone-verify — the skopeo-standalone-verify(1) glow-up 💖

okay bestie, pull up a chair, because this one is a debugging tool and I need you to hear that with your whole chest 🫶

---

✨ NAME ✨

skopeo-standalone-verify — a debugging tool that verifies an image signature from local files. that's it, that's the gig 💅

---

🌸 SYNOPSIS 🌸

skopeo standalone-verify manifest docker-reference key-fingerprints signature

---

🦋 DESCRIPTION 🦋

so what are we doing here? we're verifying a signature using local files, and if it works, the digest gets printed. success looks like a little victory lap, no cap 🎀

lowkey important though: this is primarily a debugging tool. it's useful for special cases, and it usually should not be a part of your normal operational workflow. fr fr. also, please consider configuring a signature verification policy file, as per containers-policy.json(5). that's the grown-up move ✨

now the args, one by one, no skipping 👑

• manifest — path to a file containing the image manifest 📄
• docker-reference — a docker reference that's expected to identify the image in the signature 🐳
• key-fingerprints — identities of trusted signing keys (comma separated), or any to trust any known key when using a public key file 🔑
• signature — path to the signature file ✍️

🚨 Note: if you do use this, make sure that the image can not be changed at the source location between the times of its verification and use. like, between verify o'clock and use o'clock. no sneaky swaps. 💀

---

💅 OPTIONS 💅

also peep skopeo(1) for options placed before the subcommand name, bestie 👀

• --help, -h — print usage statement. the classic. the icon. the "what does this even do" button 🌈
• --public-key-file public key file — file containing the public keys to use when verifying signatures. if this is not specified, keys from the GPG homedir are used. so either you hand me the keys, or I go dig through the GPG homedir myself 🗝️

---

⭐ EXAMPLES ⭐

look at her go 🥹

$ skopeo standalone-verify busybox-manifest.json registry.example.com/example/busybox 1D8230F6CDB6A06716E414C1DB72F2188BB46CC8  busybox.signature
Signature verified, digest sha256:20bf21ed457b390829cdbeec8795a7bea1626991fda603e0d01b4e7f60427e55

she ATE. digest printed, verification verified, main character energy confirmed 👑

---

🧚 NOTES 🧚

• this command is intended for use with local signatures, e.g. OpenPGP ( other signature formats may be added in the future ), as per containers-signature(5) 🖋️
• furthermore, this command does not interact with the artifacts generated by Docker Content Trust (DCT). for more information, please see containers-signature(5) <https://github.com/containers/image/blob/main/docs/containers-signature.5.md> 🙈

---

🔥 SEE ALSO 🔥

skopeo(1), containers-signature(5), containers-policy.json(5)

---

💜 AUTHORS 💜

• Antonio Murdaca runcom@redhat.com <mailto:runcom@redhat.com>
• Miloslav Trmac mitr@redhat.com <mailto:mitr@redhat.com>
• Jhon Honce jhonce@redhat.com <mailto:jhonce@redhat.com>

the legends themselves, we stan 🫶

---

and that's the whole page, bestie — this is skopeo-standalone-verify(1), from the skopeo-standalone-verify(1) manual, and yeah the footer is literally just skopeo-standalone-verify(1)() again with no extra source/version or date info, which is its own kind of iconic tbh 😭💖 go verify something local, stay safe, mwah 🌸