apptainer-verify

Verify a container image using the default PGP keyring

$ apptainer verify [path/to/image.sif]

$ apptainer verify --key [path/to/public.pem] [path/to/image.sif]

$ apptainer verify --certificate [path/to/certificate.pem] [path/to/image.sif]

$ apptainer verify -a [path/to/image.sif]

$ apptainer verify -g [group_id] [path/to/image.sif]

$ apptainer verify -i [object_id] [path/to/image.sif]

$ apptainer verify -j [path/to/image.sif]

apptainer verify [options] image.sif

apptainer verify validates the cryptographic signatures on SIF container images. This confirms that the image has not been tampered with and was signed by a trusted party.
Verification can use PGP public keys, X.509 certificates, or keys fetched from a keyserver. The command exits with a non-zero status if verification fails.

--key file

Path to a public key file for verification

Path to a certificate file for verification

Verify all objects in the SIF image

Verify only a specific object group

Verify only a specific object by ID

Output results in JSON format

Verification requires the public key or certificate corresponding to the signing key. Unsigned containers will fail verification. Keys from untrusted sources should not be used for verification.

apptainer(1), apptainer-sign(1), gpg(1)