# kosa8 validate verify

Check a qualification record and its signatures using nothing but the files

## Usage

```
kosa8 verify RECORD
```

Checks the package signature, every file's SHA-256, that the record's
conclusion and deviations follow from its items, that every evidence file
and the protocol match the digests the record gives, that RECORD.md is the
rendering of record.json, and every sign-off beside it: each signature by the
key it names, bound to this record. Needs no daemon, no kosa8 state and no
network. Exits non-zero on any failure.

## Flags

| Flag | Type | What it does | Default |
|---|---|---|---|
| `--pubkey` | string | the record signer's public key: a .pub file or the base64 key |  |
| `--signatures` | string | the record's signatures (default RECORD.signatures beside it) |  |

---
Source: https://docs.kosa8.com/reference/validate-verify/