# kosa8 lab verify

Check a detonation report package, offline

## Usage

```
kosa8 verify PACKAGE
```

Checks the package's Ed25519 signature, every file's SHA-256, that nothing was
added, that REPORT.md is exactly the rendering of REPORT.json, that the report
says the host enforced fakenet, and the signature and digest of the seal on the
infected snapshot. Needs nothing but the package: no daemon, no kosa8 state, no
network. Exits non-zero on any failure.

--pubkey pins the key the report must be signed with; without it a valid
signature proves only that the key inside the package signed it. --sample and
--captures check copies of the sample and of the capture segments against the
digests in the report. The snapshot itself is checked where it is, with
`kosa8 snapshot verify`.

## Flags

| Flag | Type | What it does | Default |
|---|---|---|---|
| `--captures` | string | directory holding copies of the capture segments, to check against the report |  |
| `--pubkey` | string | public key the report must be signed with: a .pub file or the base64 key |  |
| `--sample` | string | a copy of the sample, to check against the report's digest |  |

---
Source: https://docs.kosa8.com/reference/lab-verify/