Commands / kosa8 evidence verify
kosa8 evidence verify
Check an evidence package using nothing but the package
Usage
kosa8 verify PACKAGE
Checks the package signature, every file's SHA-256, every seal's and approval's signature, that every reference resolves to something in the package, and that the audit entries form one unbroken chain segment. Needs no daemon, no kosa8 state and no network. Exits non-zero on any failure.
--pubkey pins the exporter's key; without it a valid signature proves only that the key in the manifest signed it. --audit-key (the exporting machine's ~/.kosa8/audit.key, held in escrow by the organisation) also checks that the machine's key wrote every entry — which nobody without that key can check.
Options
| Flag | Type | What it does | Default |
|---|---|---|---|
--audit-key | string | the exporting machine's audit.key (file or hex), to check every entry's HMAC | — |
--policy-key | string | the org policy signer's public key, to pin the policy the approvals were made under | — |
--pubkey | string | the exporter's public key: a .pub file or the base64 key | — |