openregs verify

Check that stored artefacts still match the digests they are stored under.

Verify stored bytes against their own digests. --snapshots scans the raw snapshot store: every payload is read back and re-hashed against the key it is stored under, and every WARC capture record is re-verified against the payload it names. --release <regime>@<tag> verifies a signed release instead: every artifact’s signature, every declared digest, the provenance chain from the tag through the commit and the CI run to the snapshot hashes in SOURCES.lock, and inclusion in the transparency log — proven against the checkpoint bundled in the release, so the whole check runs with no network at all. --answer <path> adds the hop those five cannot make on their own: it resolves the release a saved answer names, runs the same five over it, and then checks the answer’s own words — every block’s text against the unit or atom its citation names in the verified bundle, and every obligation’s quoted text against source_text[char_start:char_end] — so that the claim stops being ‘this answer names a release, and that release is authentic’ and becomes ‘these words are that release’s words’. Nothing is trusted, which is what makes all three worth running.

openregs verify [-h] [--snapshots] [--store <path>] [--state-dir <path>]
                       [--release <regime>@<tag>] [--answer <answer.json>] [--path <release-dir>]
                       [--key <cosign.pub>] [--log-key <log.pub>] [--trust <path>] [--root <path>]

Option
--snapshots	run the raw snapshot store’s integrity scan
--store <path>	scan this store root instead of <state-dir>/snapshots
--state-dir <path>	find the snapshot store under this state directory instead of state/
--release <regime>@<tag>	verify a signed release instead: signatures, digests, the provenance chain (tag -> commit -> CI run -> snapshots) and transparency-log inclusion, all offline against the checkpoint bundled in the release
--answer <answer.json>	walk a saved answer back to the release it names: the five checks above over that release, then every block’s text against the unit or atom its citation names in the verified bundle, and every obligation’s quoted text against source_text[char_start:char_end]. Point --path at a vendored release directory and the whole walk runs on the holder’s own machine, offline, trusting neither the answer nor whoever served it
--path <release-dir>	verify the release in this directory instead of resolving --release in the checkout
--key <cosign.pub>	a signing key to accept, repeatable. Given, it replaces the roster: the release’s own copy of its public key is never an anchor. Default: config/trust.yaml (repeatable)
--log-key <log.pub>	a transparency-log key to accept, repeatable (repeatable)
--trust <path>	read the trust roster here instead of config/trust.yaml
--root <path>	repository root