Verify an attestation

Check that a report came from the scanner it claims to, unmodified.

Verify locally#

ztvs verify report.json --attestation report.json.att

Exit 0 means every claim held. Any other code means do not trust the report.

Verify in CI, without ZTVS#

The attestation is a detached signature over a canonical JSON subject, so any verifier can check it:

ztvs attest show report.json.att --format subject > subject.json
cosign verify-blob subject.json \
  --signature report.json.att \
  --certificate-identity-regexp '^https://github\.com/your-org/'

What the attestation covers#

Claim Meaning
subject.digest The report bytes, hashed
scanner.version Which ZTVS produced it
advisories.snapshot Which advisory data it used
policy.digest Which policy was applied, if any
target.digest What was scanned

It does not cover whether the scan was correct. It covers that this report, from this scanner, with this data, over this target, has not been altered. Those are different claims and conflating them is how people end up trusting a signature more than it deserves.

Rotating keys#

ztvs attest keygen --out ztvs-signing.key
ztvs scan ./svc --attest --key ztvs-signing.key

Old attestations remain verifiable against the old public key. Keep retired public keys published for as long as the reports they signed are retained.