Documentation

Verify a receipt

Check its signature, who signed it and whether it was witnessed.

Receipt file
Choose a receipt to verify JSON · Up to 2 MiB · Files stay in your browser
Paste JSON instead
Supporting files and trusted context

These files establish deployment identity and Notary trust. Your receipt provider supplies them separately.

Use the pin from your authenticated release. A pin supplied by the receipt alone cannot establish trust.

Use the CLI

Download Linux x86-64 CLI v0.1.75
Install and verify from your terminal

Run in a new directory with curl, cosign and tar installed. These commands check the download before extracting it.

curl --fail --location --remote-name-all \
  'https://download.glacis.io/api/verify/v0.1.75/glacis-verify-linux-x86_64.tar.gz' \
  'https://download.glacis.io/api/verify/v0.1.75/release-deployment.json' \
  'https://download.glacis.io/api/verify/v0.1.75/SHA256SUMS.verifier.txt' \
  'https://download.glacis.io/api/verify/v0.1.75/SHA256SUMS.verifier.txt.cosign-bundle' &&
cosign verify-blob \
  --bundle SHA256SUMS.verifier.txt.cosign-bundle \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --certificate-identity-regexp '^https://github\.com/(Glacis-io/glacis-monorepo)/\.github/workflows/release\.yml@refs/tags/v0\.1\.75$' \
  SHA256SUMS.verifier.txt &&
awk -v archive='glacis-verify-linux-x86_64.tar.gz' '
  $2 == archive || $2 == "release-deployment.json" { count[$2]++; print }
  END { if (count[archive] != 1 || count["release-deployment.json"] != 1) exit 1 }
' SHA256SUMS.verifier.txt > verifier-checksums.txt &&
{ if command -v sha256sum >/dev/null; then
  sha256sum --check verifier-checksums.txt
else
  shasum -a 256 --check verifier-checksums.txt
fi; } &&
tar -xzf 'glacis-verify-linux-x86_64.tar.gz' &&
./glacis-verify --version &&
./glacis-verify verify receipt.json

For identity and witness checks, use the anchor digest from the authenticated release-deployment.json and your agreed deployment context.

Trust anchors · Key registry

./glacis-verify verify receipt.json --context context.json --trust-anchors activation-trust-anchors.json --anchor-sha256 "$VERIFIED_ANCHOR_SHA256" --key-registry interim-key-registry.v1.json
Try a synthetic V3 example

A signed test receipt with test trust data. Select an example, then Verify receipt.