noqtis-verify(1)

NAME

noqtis-verify — check an ML-DSA or SLH-DSA signature of a file

SYNOPSIS

noqtis verify -p key.pub -s sig [-c ctx] [--ph hash] [-q] file

noqtis verify -p key.pub --dsse [-o payload] [-q] envelope

DESCRIPTION

noqtis verify checks that sig is a valid signature of the bytes of file under the public key in key.pub. On success it prints

<file>: OK
  (<alg>)

On failure it prints to standard error why (“the signature does not verify”, or the signature's length when it is not the algorithm's). file may be ‘-’ for standard input.

-p key.pub, --pub=key.pub: A public signature key file (‘noqtis-key-1 <alg> pub’). The algorithm comes from the key file.
-s sig, --sig=sig: The raw signature.
-c ctx, --ctx=ctx: The context string the signer used (at most 255 bytes; default empty).
--ph hash: Verify a pre-hash (HashML-DSA, HashSLH-DSA) signature made with hash; the names are those of noqtis-sign(1).
-q, --quiet: Print nothing on success; only the exit status tells.
--dsse: Check a DSSE envelope (noqtis-export(1) --as dsse) instead: one of its signatures must verify under key.pub over the envelope's pre-authentication encoding; then ‘<envelope>: OK (<alg>), payloadType <type>’ is printed.
-o payload, --out=payload: With --dsse: write the envelope's payload to payload.

EXIT STATUS

0: The signature is valid.
1: It is not: a wrong signature, file, key, context or pre-hash, or a signature of the wrong length.
2: A usage error, a key that is not a public signature key, or a file that cannot be read.

EXAMPLES

$ noqtis verify -p me.pub -s report.pdf.sig report.pdf
report.pdf: OK (ML-DSA-65)
$ echo changed >> report.pdf
$ noqtis verify -p me.pub -s report.pdf.sig report.pdf; echo $?
noqtis verify: report.pdf: FAILED: the signature does not verify
1

In a script:

if noqtis verify -q -p me.pub -s data.sig data.csv; then
  echo trusted
fi