# kosa8 attack verify

Check a signed attack scorecard

## Usage

```
kosa8 verify FILE
```

Checks the signature over the scorecard, that its results match their digest, and
whether the signing key is one that has signed this machine's audit log. --kid
pins the key (as `kosa8 audit key` prints it on the machine that ran the suite);
without it, a valid signature proves only that the key in the file signed it.
Needs no daemon. Exits non-zero on any failure.

## Flags

| Flag | Type | What it does | Default |
|---|---|---|---|
| `--kid` | string | the signing key id to require (SHA256:…) |  |

---
Source: https://docs.kosa8.com/reference/attack-verify/