openregs verify

Check that stored artefacts still match the digests they are stored under.

Verify stored bytes against their own digests. —snapshots scans the raw snapshot store: every payload is read back and re-hashed against the key it is stored under, and every WARC capture record is re-verified against the payload it names. —release @ verifies a signed release instead: every artifact’s signature, every declared digest, the provenance chain from the tag through the commit and the CI run to the snapshot hashes in SOURCES.lock, and inclusion in the transparency log — proven against the checkpoint bundled in the release, so the whole check runs with no network at all. Nothing is trusted, which is what makes both worth running.

openregs verify [-h] [--snapshots] [--store <path>] [--state-dir <path>]
                       [--release <regime>@<tag>] [--path <release-dir>] [--key <cosign.pub>]
                       [--log-key <log.pub>] [--trust <path>] [--root <path>]

Option
--snapshots	run the raw snapshot store’s integrity scan
--store <path>	scan this store root instead of <state-dir>/snapshots
--state-dir <path>	find the snapshot store under this state directory instead of state/
--release <regime>@<tag>	verify a signed release instead: signatures, digests, the provenance chain (tag -> commit -> CI run -> snapshots) and transparency-log inclusion, all offline against the checkpoint bundled in the release
--path <release-dir>	verify the release in this directory instead of resolving —release in the checkout
--key <cosign.pub>	a signing key to accept, repeatable. Given, it replaces the roster: the release’s own copy of its public key is never an anchor. Default: config/trust.yaml (repeatable)
--log-key <log.pub>	a transparency-log key to accept, repeatable (repeatable)
--trust <path>	read the trust roster here instead of config/trust.yaml
--root <path>	repository root