Verification - vibrantleaf/sharkfin GitHub Wiki

These images are signed with Sigstore's cosign. You can verify the signature by downloading the cosign.pub file from this repo and running the following command:

curl -L -o ~/.cache/com.github.vibrantleaf.sharkfin.cosign.pub https://raw.githubusercontent.com/vibrantleaf/sharkfin/refs/heads/main/cosign.pub

cosign verify --key ~/.cache/com.github.vibrantleaf.sharkfin.cosign.pub ghcr.io/vibrantleaf/sharkfin:stable

cosign verify --key ~/.cache/com.github.vibrantleaf.sharkfin.cosign.pub ghcr.io/vibrantleaf/sharkfin-dx:stable

cosign verify --key ~/.cache/com.github.vibrantleaf.sharkfin.cosign.pub ghcr.io/vibrantleaf/sharkfin-nvidia:stable

cosign verify --key ~/.cache/com.github.vibrantleaf.sharkfin.cosign.pub ghcr.io/vibrantleaf/sharkfin-dx-nvidia:stable

This command's output should not say that are no matching signatures