verify-catalog

Overview ¶

Command verify-catalog is the deployer admission path for a capability catalog. It verifies the detached PKCS#7 signature over the exact catalog bytes, re-checks the trust chain and AIC binding, and recomputes the decision from the local policy and accepted-generation state. Nothing in the artifact is trusted to say "verified".

Usage:

verify-catalog -catalog C -signature S -trust ROOTS -policy P.json
               [-state S.json] [-state-out S.next.json]

Exit status: 0 accept, 2 reject, 1 usage or I/O failure.