packer verify-attestation command

The packer verify-attestation command verifies a signed DSSE attestation. You can also require an expected predicate type, builder identity, source URI, or artifact digest.

Usage

packer verify-attestation [OPTIONS] ATTESTATION

ATTESTATION must be a path to a DSSE attestation file.

Options

• -signing-mode - Signing mode: key, kms, or keyless. Packer detects the mode when possible.
• -key - PEM key path, KMS URI or Vault URI.
• -verifier - PEM verifier path.
• -predicate-type - Expected attestation predicate type.
• -builder-id - Expected SLSA builder ID.
• -source-uri - Expected resolved source URI.
• -artifact - Artifact path to match against attestation subjects.
• -trusted-root-path - Path to a Sigstore trusted-root JSON file for keyless verification.
• -keyless-identity - Expected keyless signing identity.
• -keyless-oidc-issuer - Expected OpenID Connect (OIDC) issuer for keyless signing.
• -bundle - Path to a Sigstore bundle JSON file for Rekor or timestamp verification.
• -require-rekor - Require Rekor transparency-log verification from the bundle.
• -require-timestamp - Require a trusted observer timestamp from Rekor integrated time or RFC 3161 evidence.

Example

The following command verifies an attestation signed with a PEM key:

packer verify-attestation \
  -signing-mode=key \
  -verifier=keys/provenance-signing.pub.pem \
  provenance.intoto.json