# kosa8 evidence verify

Check an evidence package using nothing but the package

## Usage

```
kosa8 verify PACKAGE | --web FILE
```

Checks the package signature, every file's SHA-256, every seal's and
approval's signature, that every reference resolves to something in the
package, and that the audit entries form one unbroken chain segment. Needs
no daemon, no kosa8 state and no network. Exits non-zero on any failure.

--pubkey pins the exporter's key; without it a valid signature proves only
that the key in the manifest signed it. --audit-key (the exporting machine's
~/.kosa8/audit.key, held in escrow by the organisation) also checks that the
machine's key wrote every entry — which nobody without that key can check.

--web FILE writes the same check as one HTML page, to hand to whoever receives
a package: they open it in a browser and drop the package on it, with no kosa8
and no network (the page cannot make requests). It checks everything this
command checks without --audit-key.

## Flags

| Flag | Type | What it does | Default |
|---|---|---|---|
| `--audit-key` | string | the exporting machine's audit.key (file or hex), to check every entry's HMAC |  |
| `--policy-key` | string | the org policy signer's public key, to pin the policy the approvals were made under |  |
| `--pubkey` | string | the exporter's public key: a .pub file or the base64 key |  |
| `--web` | string | write the offline browser verifier (one HTML file) to FILE instead of verifying |  |

---
Source: https://docs.kosa8.com/reference/evidence-verify/