sshpk-verify(1)

💖 sshpk-verify — bestie's guide to checking signatures 💖

okay so real talk, this is a page from the sshpk Commands manual, and it's about sshpk-verify. it does exactly what it says on the tin: it takes some bytes and a signature and tells you whether that signature actually came from the private half of the SSH public key you handed it. no cap. 🫶

---

✨ NAME ✨

sshpk-verify — verify a signature on data using an SSH key

---

🌸 SYNOPSYS 🌸

sshpk-verify -i KEYPATH -s SIGNATURE [OPTION...]

---

🦋 DESCRIPTION 🦋

so basically it takes in arbitrary bytes and a Base64-encoded signature, and then it verifies that the signature was produced by the private half of the given SSH public key. that's it, that's the whole vibe. it's giving "trust but verify" and honestly? iconic. 👑

---

⭐ EXAMPLES ⭐

watch this, it's so satisfying:

$ printf 'foo' | sshpk-verify -i ~/.ssh/id_ecdsa -s MEUCIQCYp...
OK
$ printf 'foo' | sshpk-verify -i ~/.ssh/id_ecdsa -s GARBAGE...
NOT OK

first one ate and left no crumbs. second one... yeah that's a NOT OK bestie, the signature didn't match. 💀

---

💅 EXIT STATUS 💅

the exit codes are literally the whole personality of this command:

• 0 — signature validates and matches the key. slay. 💖
• 1 — signature is parseable and the correct length, but it does not match the key, or it's otherwise invalid. so close yet so far 😭
• 2 — the signature or the key could not be parsed. couldn't even read it, embarrassing for the input ngl.
• 3 — invalid commandline options were supplied. bestie. read the options. 🙈

---

🎀 OPTIONS 🎀

• -v, --verbose — print extra information about the key and signature to stderr when verifying. it's the "tell me everything" option and honestly we love a yapper.
• -i KEY, --identity=KEY — select the key to be used for verification. KEY must be a relative or absolute filesystem path to the key file. any format supported by the sshpk library is supported, including OpenSSH formats and standard PEM PKCS. so many formats, all welcome here 🌈
• -s BASE64, --signature=BASE64 — supplies the base64-encoded signature to be verified. this is the receipts, bestie 🧾✨
• -f PATH, --file=PATH — input file to verify instead of stdin. for when piping isn't the mood.
• -H HASH, --hash=HASH — set the hash algorithm to be used for signing. this should be one of sha1, sha256 or sha512. some key types may place restrictions on which hash algorithms may be used (e.g. ED25519 keys can only use SHA-512). so like, check before you commit, iykyk.
• -t FORMAT, --format=FORMAT — choose the signature format to use, from asn1, ssh or raw (only for ED25519 signatures). the asn1 format is the default, as it is the format used with TLS and typically the standard in most non-SSH libraries (e.g. OpenSSL). the ssh format is used in the SSH protocol and by the ssh-agent. pick your fighter 🥊

---

👑 SEE ALSO 👑

• sshpk-sign(1) — the other half of the duo, go say hi

---

💀 BUGS 💀

Report bugs at Github ⟨https://github.com/arekinath/node-sshpk/issues⟩

not me telling you to go file a bug report but like... if you found one, go file one fr fr 🫶

---

okay that's the whole page!! this one is from sshpk, dated Jan 2016, and it lives in section 1 as sshpk-verify(1). now go forth and verify some signatures, bestie — you're the main character of this terminal 🧚💜