Instructions for Signature Verification of the Provenance File

In this example we verify the signature of the SLSA provenance file of a Ghaf Lenovo X1 Carbon package.

Step-by-step instructions:

• Download and extract the package in an empty directory

  mkdir verify
  cd verify
  wget https://ghafreleasesstorage.z16.web.core.windows.net/ghaf-24-09-2/files/packages.x86_64-linux.lenovo-x1-carbon-gen11-debug.tar
  tar -xf *.tar
  cd packages.x86_64-linux.lenovo-x1-carbon-gen11-debug
  cd scs
                                      

• Verify the signature

  nix run github:tiiuae/ci-yubi/bdb2dbf#verify -- --path provenance.json --sigfile provenance.json.sig
                                      

Example output of successful signature verification

[ktu@X1-nixos:~/verify/packages.x86_64-linux.lenovo-x1-carbon-gen11-debug/scs]$ nix run github:tiiuae/ci-yubi/bdb2dbf#verify -- --path provenance.json --sigfile provenance.json.sig 
Signature verification result: {'message': 'Signature Verification Result', 'is_valid': True}