@sigstore/verify

Verifying signatures of software artifacts

This feature allows you to verify the signature of a software artifact against a public key to ensure its integrity and authenticity. The code sample demonstrates how to use the `verifySignature` function to perform this verification.

const { verifySignature } = require('@sigstore/verify');

async function verify() {
  const result = await verifySignature('path/to/artifact', 'path/to/signature', 'path/to/publicKey');
  console.log(result);
}

verify();

Verifying certificates

This functionality enables the verification of a certificate to ensure it is valid and has been issued by a trusted certificate authority. The provided code sample shows how to use the `verifyCertificate` function for this purpose.

const { verifyCertificate } = require('@sigstore/verify');

async function verify() {
  const result = await verifyCertificate('path/to/certificate');
  console.log(result);
}

verify();