SOPV-VERIFY(1)

💖 SOPV-VERIFY(1) 💖

okay bestie, gather round, because this is the Stateless OpenPGP Signature Verification page and it's genuinely so important. it's giving "cryptographic trust but make it fashion". let's go 🫶

---

✨ NAME ✨

sopv-verify — verify detached OpenPGP signatures on a message

🦋 SYNOPSIS 🦋

sopv [--debug] verify [--not-before=DATE] [--not-after=DATE] [--]
SIGNATURES CERTS [CERTS...] <DATA

💅 DESCRIPTION 💅

so sopv verify reads the data from standard input, and it looks at all your SIGNATURES and all your CERTS, and if any valid OpenPGP detached signature made over that stdin data comes from one of the specified OpenPGP certificates? it returns 0. slay. 🎀

and if no valid OpenPGP signature is found? it returns non-zero. not slay. 💀

it emits a stream of VERIFICATIONS (see VERIFICATIONS in sopv(1)) to standard output. yes, you get receipts. periodt.

🌸 EXAMPLES 🌸

the classic "is this even signed" vibe check:

if sopv verify message.sig signer.cert < message > /dev/null; then
    echo "message is signed"
else
    echo "no valid signature found"
fi

now the ✨iconic✨ one — a no-rollbacks mechanism (for example, for software upgrades). this is the "no going back to the old version, i said what i said" move:

LASTSIGDATE=$(cat lastsigdate || echo '1970-01-01T00:00:00Z')
rm -f verifs.out
if sopv verify --not-before=$LASTSIGDATE $SIG author.cert < $PKG > verifs.out; then
   # do something with the now-verified "$PKG":
   #  ...
   # prevent rollback to prior version:
   cut -f1 -d' ' < verifs.out | head -n1 > lastsigdate
fi

🔥 OPTIONS 🔥

• --not-before=DATE — nope, we are not accepting signatures made before the specified DATE. supply DATE in ISO-8601 format, preferably in UTC (see DATE in sopv(1)). it's a cutoff, bestie.
• --not-after=DATE — and we are not accepting signatures made after the specified DATE either. supply DATE in ISO-8601 format, preferably in UTC (see DATE in sopv(1)).

also hi, there's a --debug flag in the synopsis, and a bare -- if you need it to stop parsing options. the page itself only documents --not-before and --not-after down here, so that's what you get from me too. 🫶

🧚 ARGUMENTS 🧚

sopv verify goes looking for OpenPGP signatures in the SIGNATURES argument, and it'll accept them either as a series of raw OpenPGP signature packets, or as an ASCII-armored series of OpenPGP signature packets. either way, werk. ✨

but here's the thing — for those signatures to actually get verified, they must be made by one of the supplied CERTS, over the message provided on standard input. that's the whole deal, no cap.

any invalid or broken signature will be ignored, and so will any signature made by an unknown signer. it's not being rude, it's just not the vibe. 🙈

and one or more CERTS arguments should point to OpenPGP certificates that would be acceptable signers. plural, bestie. you can bring friends.

👑 RETURN CODE 👑

sopv verify returns 0 to indicate that at least one valid signature was found. that's the win condition. 💖

it may fail for other reasons, but NO_SIGNATURE (3) is a likely failure mode when none of the SIGNATURES can be verified as being from any of the CERTS. so if you see a 3, that's what happened.

🌈 AUTHOR 🌈

this manual page was written by Daniel Kahn Gillmor. your implementation of sopv is likely written by someone else in alignment with the SOP specification — different hands, same spec, main character energy all around. please run sopv version to learn more about your implementation. 💅

⭐ SEE ALSO ⭐

• sopv(1)
• sopv-version(1)
• sopv-inline-verify(1)
• Stateless OpenPGP Command Line Interface — https://datatracker.ietf.org/doc/draft-dkg-openpgp-stateless-cli/
• RFC 9580 — https://www.rfc-editor.org/rfc/rfc9580.html

---

and that's the whole page, bestie!! this one's from sopv version 1.1, dated March 2025 — so if you're reading this, mwah, thanks for scrolling all the way down, you ate. 💜✨🎀