Commands / kosa8 lab verify
kosa8 lab verify
Check a detonation report package, offline
Usage
kosa8 verify PACKAGE
Checks the package's Ed25519 signature, every file's SHA-256, that nothing was added, that REPORT.md is exactly the rendering of REPORT.json, that the report says the host enforced fakenet, and the signature and digest of the seal on the infected snapshot. Needs nothing but the package: no daemon, no kosa8 state, no network. Exits non-zero on any failure.
--pubkey pins the key the report must be signed with; without it a valid
signature proves only that the key inside the package signed it. --sample and
--captures check copies of the sample and of the capture segments against the
digests in the report. The snapshot itself is checked where it is, with
kosa8 snapshot verify.
Options
| Flag | Type | What it does | Default |
|---|---|---|---|
--captures | string | directory holding copies of the capture segments, to check against the report | — |
--pubkey | string | public key the report must be signed with: a .pub file or the base64 key | — |
--sample | string | a copy of the sample, to check against the report's digest | — |