Verify Evidence CLI
Verify evidence integrity and signatures for an artifact, package, build, or Release Bundle using the JFrog CLI.
The Verify Evidence command provides client-side verification that the evidence related to a given subject has not been altered. Verification of artifact integrity is performed using a checksum (digest), and attestation signatures are validated using public keys.
This command can be run on a variety of evidence subjects, including artifacts, packages, builds, and Release Bundles. It requires you to define the evidence subject and the keys to use for verification.
Note
When working in a Federated environment, evidence can be verified only on those members that contain the public key. You must upload the public key manually to each Federation member.
Syntax
Artifact Evidence
jf evd verify --subject-repo-path <target-path> --public-keys <key-array>Package Evidence
jf evd verify --package-name <package-name> --package-version <package-version> --public-keys <key-array>Build Evidence
jf evd verify --build-name <build-name> --build-number <build-number> --public-keys <key-array>Release Bundle v2 Evidence
jf evd verify --release-bundle <name> --release-bundle-version <version-number> --public-keys <key-array>Command Parameters
The following table describes the parameters common to all Verify Evidence commands.
| Parameter | Required/Optional | Type | Description |
|---|---|---|---|
--public-keys | required (unless the | array:string | An array of public keys to use for signature verification with ";" separator. Supported key types: ecdsa, rsa, ed25519 |
--project | optional | string | The project key associated with the created evidence. |
--format | optional | string | Enables extended output. Supported format: json. |
--use-artifactory-keys | optional | boolean | Default: When enabled, the command retrieves keys from Artifactory to perform verification. |
Artifact Command Parameters
The following table describes the artifact-specific Verify Evidence command parameters.
| Parameter | Required/Optional | Type | Description |
|---|---|---|---|
--subject-repo-path | optional | string | The full path to the evidence subject. |
Package Command Parameters
The following table describes the package-specific Verify Evidence command parameters.
| Parameter | Required/Optional | Type | Description |
|---|---|---|---|
--package-name | optional | string | The package name. |
--package-repo-name | optional | string | The package repository name. |
--package-version | optional | string | The package version. |
Build Command Parameters
The following table describes the build-specific Verify Evidence command parameters.
| Parameter | Required/Optional | Type | Description |
|---|---|---|---|
--build-name | optional | string | The build name. |
--build-number | optional | string | The build number. |
Release Bundle Command Parameters
The following table describes the Release Bundle-specific Verify Evidence command parameters.
| Parameter | Required/Optional | Type | Description |
|---|---|---|---|
--release-bundle | optional | string | The Release Bundle name. |
--release-bundle-version | optional | string | The Release Bundle version. |
Sample Command
The following command verifies Sigstore bundle evidence on an artifact using keys retrieved from Artifactory.
Subject sha256: 4bf2da010af20d8ed0364caf14f90bcab22b312520c68b9a01bb3479ba9a742c
Subject: cli-sigstore-test/readme.txt
Loaded 3 evidence
Verification passed for 3 out of 3 evidence
- Evidence 1:
- Media type: sigstore.bundle
- Predicate type: in-toto
- Evidence subject sha256: 4bf2da010af20d8ed0364caf14f90bcab22b312520c68b9a01bb3479ba9a742c
- Key source: Sigstore Bundle Key
- Sigstore verification status: success
- Evidence 2:
- Media type: evidence.dsse
- Predicate type: application/vnd.in-toto+json
- Evidence subject sha256: 4bf2da010af20d8ed0364caf14f90bcab22b312520c68b9a01bb3479ba9a742c
- Key source: User Provided Key
- Key fingerprint: /IyvutGSsuTPykv+mGtG4sph4TGh3Cl4HRNxbEZo1z4=
- Sha256 verification status: success
- Signatures verification status: success
- Attachments verification status: success
- Evidence 3:
- Media type: evidence.dsse
- Predicate type: vulnerability-scan
- Evidence subject sha256: 4bf2da010af20d8ed0364caf14f90bcab22b312520c68b9a01bb3479ba9a742c
- Key source: Artifactory Key
- Key fingerprint: uz1SAgymeLMkH+lJ5ROCvbTCCnbwgUgy3zeDAR4J47k=
- Sha256 verification status: success
- Signatures verification status: successSee the Evidence JSON format output.
Frequently Asked Questions
Common questions about verifying evidence with the JFrog CLI.
FAQs
Q: How do I verify evidence for an artifact using the JFrog CLI?
A: Run jf evd verify --subject-repo-path <target-path> --public-keys <key-array> to verify evidence signatures for that artifact. See the Command Parameters table for all supported flags.
Q: What is the difference between using --public-keys and --use-artifactory-keys?
--public-keys and --use-artifactory-keys?A: --public-keys lets you supply an array of public keys directly for verification. --use-artifactory-keys retrieves keys from Artifactory instead, so you don't need to provide --public-keys.
Q: What evidence subjects can I verify?
A: You can verify evidence for artifacts, packages, builds, and Release Bundles using the matching parameters, such as --subject-repo-path for artifacts or --build-name and --build-number for builds.
Q: What happens when working in a Federated environment?
A: Evidence can be verified only on Federation members that contain the public key, so you must upload the public key manually to each member.
Q: What key types are supported for verification?
A: The --public-keys parameter supports ecdsa, rsa, and ed25519 key types.
Related Topics
Updated 3 days ago