--- updatedAt: 2026-07-21T08:04:38.000Z agentTools: siteIndex: https://docs.jfrog.com/llms.txt projectIndex: https://docs.jfrog.com/governance/llms.txt --- # Verify Release Bundle v2 Versions Learn how to verify Release Bundle v2 signatures and artifact digests independently using APIs and CLI tools. RLM Deprecation All feature development, patches, and security fixes for Release Lifecycle Management ended on **July 31, 2026**, except for critical security fixes. RLM End of Life is currently scheduled for **January 31, 2028**. For more information, see JFrog Release Lifecycle Management Deprecation - End of Life. You can verify the signature and contents of a [Release Bundle v2](/docs/understanding-release-bundles-v2) version independently to confirm that: * The Release Bundle manifest has not been tampered with en route to its current location, for example a deployment server * The artifacts contained in the Release Bundle have not been tampered with en route For other management tasks, see [Manage Release Bundle v2 Versions](/docs/manage-release-bundle-v2-versions). **To verify the signature and contents of a Release Bundle v2 version:** 1. Use the [Get Release Bundle v2 Version Signature](/reference/getBundleVersionSignature) API to get the Release Bundle manifest file: ```shell GET /lifecycle/api/v2/release_bundle/signatures//?project=default ``` Where: * ``: The Artifactory host URL * ``: The Release Bundle name * ``: The Release Bundle version Sample result: ```json { "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJ1...", "payloadType": "application/vnd.in-toto+json", "signatures": [ { "keyid": "PGP-RSA-2048", "sig": "LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KVmVyc2lvbjogQkNQRyB2QFJFTEVBU0..." } ] } ``` 2. Use the [Get Key Pair](/administration/reference/getKeyPair) API to get the public key from JFrog Artifactory using the `keyid` defined in the Release Bundle manifest: ```shell GET /artifactory/api/security/keypair/ ``` Where: * ``: The `keyid` value from the Release Bundle manifest Sample result: ```json { "pairName": "PGP-RSA-2048", "pairType": "GPG", "alias": "pgp-rsa-2048", "publicKey": "-----BEGIN PGP PUBLIC KEY BLOCK----- \n\nmI0EZJA1TAEEAOjFw17MiG608NR60PZ/zpX7GoOjJr2/CNUQwytQXC3BPWMkuVTx\nxajKZj6... -----END PGP PUBLIC KEY BLOCK-----", "unavailable": false } ``` 3. Verify the DSSE signature in the manifest file. The following is a sample Bash script for performing signature verification: ```shell # -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- # Construct a PAE (Pre-Authentication Encoding) according to the DSSE protocol. # Use the payload type from in-toto Attestation Framework. Save it as a new file. # function build_pre_auth_encoding() { payload=$(cat "evidence.json" | jq '.payload' -r | base64 -d) payload_length=${#payload} payload_type=$(cat "evidence.json" | jq '.payloadType' -r) payload_type_length=${#payload_type} echo "DSSEv1 $payload_type_length $payload_type $payload_length $payload\c" > "pae.txt" } # -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- # Verify a digital signature (RSA-2048 + SHA-256GPG) for PAE. # function verify_digital_signature() { signature=$(cat "evidence.json" | jq '.signatures[0].sig' -r | base64 -d) echo "$signature" >> "signature.txt" gpg --import public.key gpg --verify signature.txt pae.txt # [when using RSA keys, see note below] } # == == == == == == == == == == == == == == == == == == == == == == == == == == # WORKFLOW: build_pre_auth_encoding verify_digital_signature ``` ### **Note** When using RSA keys without GPG, replace these commands: `gpg --import public.key` `gpg --verify signature.txt pae.txt` with the following command: `openssl dgst -sha256 -verify public.key -signature "signature.txt" "pae.txt"` 4. Verify the artifacts in the Release Bundle. The following is a sample command for getting the list of artifacts from the manifest and comparing each artifact to its sha256 digest: ```shell cat release-bundle.json | jq .payload -r | base64 -d | jq '[.subject[]|{uri, digest}]' ``` ```json [ { "uri": "artifacts/docker/commons/1.0.0/manifest.json", "digest": { "sha256": "c32c8946f9fce70a153a06b99636f8269fa869825fe0ce5de7efd8b7" } }, { "uri": "artifacts/docker/commons/1.0.0/sha256__9270ca3b7b122596e6871820724eb9fd16bd", "digest": { "sha256": "9270ca2a0ad3396353d2fe727b12143ac562596e6871820724eb9fd16bd" } }, { "uri": "artifacts/generic/commons-1.0.0.txt", "digest": { "sha256": "f87e4c72e60300b451739d545afc0251a6e2f4bd1b1902ba739455897ecb8" } } ] ``` ### **Tip** Use the `sha256sum` utility to calculate the actual sha256 of the files in the Release Bundle. For example: ```shell sha256sum commons-1.0.0.txt f87e4c72e60300b451739d545afc0251a6e2f4bd1b1902ba739455897ecb8 commons-1.0.0.txt ``` You can then compare this calculated value with the value defined in the Release Bundle manifest. ## Frequently Asked Questions This section provides answers to frequently asked questions about verifying Release Bundle v2 versions. ##### Q: Why would I verify a Release Bundle v2 version independently? **A:** Independent verification confirms that the manifest and artifacts were not tampered with en route, for example to a deployment server. See [Verify the Signature and Contents](#verify-the-signature-and-contents). ##### Q: Which API returns the Release Bundle v2 signature? **A:** Use the [Get Release Bundle v2 Version Signature](/reference/getBundleVersionSignature) API to get the manifest payload and signatures. See step 1 under [Verify the Signature and Contents](#verify-the-signature-and-contents). ##### Q: How do I verify the DSSE signature without GPG? **A:** Use OpenSSL instead of GPG: `openssl dgst -sha256 -verify public.key -signature "signature.txt" "pae.txt"`. See the **Note** callout in step 3 of [Verify the Signature and Contents](#verify-the-signature-and-contents). ##### Q: How do I confirm artifact digests match the manifest? **A:** Extract subject URIs and digests from the manifest with `jq`, then compare each file to its sha256 using `sha256sum`. See step 4 under [Verify the Signature and Contents](#verify-the-signature-and-contents). ## Related Topics * [Manage Release Bundle v2 Versions](/docs/manage-release-bundle-v2-versions) * [Get Release Bundle v2 Version Signature](/reference/getBundleVersionSignature) * [Understanding Release Bundles v2](/docs/understanding-release-bundles-v2) * [Release Lifecycle Management](/docs/release-lifecycle-management)