---
name: "sopv-verify"
section: "1"
platform: "linux"
package: "sopv-doc"
version: "1.1.1-1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/sopv-verify"
---

# sopv-verify(1)

Verify detached OpenPGP signatures on a message

## NAME

**sopv-verify** - Verify detached OpenPGP signatures on a message

## SYNOPSIS

**sopv** \[**--debug**\] **verify** \[**--not-before=***DATE*\] \[**--not-after=***DATE*\] \[**--**\] *SIGNATURES* *CERTS* \[*CERTS*...\] *\<DATA*

## DESCRIPTION

**sopv verify** returns 0 if any valid OpenPGP detached signature is made over the data on standard input from one of the specified OpenPGP certificates. If no valid OpenPGP signature is found, **sopv verify** returns non-zero.

It emits a stream of **VERIFICATIONS** (see **VERIFICATIONS** in [sopv(1)](/sopv/1.md)) to standard output.

## EXAMPLES

```
if sopv verify message.sig signer.cert < message > /dev/null; then
    echo "message is signed"
else
    echo "no valid signature found"
fi
```

To implement a no-rollbacks mechanism (e.g. for software upgrades):

-

  ```
  LASTSIGDATE=$(cat lastsigdate || echo '1970-01-01T00:00:00Z')
  rm -f verifs.out
  if sopv verify --not-before=$LASTSIGDATE $SIG author.cert < $PKG > verifs.out; then
     # do something with the now-verified "$PKG":
     #  ...
     # prevent rollback to prior version:
     cut -f1 -d' ' < verifs.out | head -n1 > lastsigdate
  fi
  ```

-

  ## OPTIONS

- **--not-before=***DATE*

  Do not accept signatures made before the specified *DATE*. Supply *DATE* in ISO-8601 format, preferably in UTC (see **DATE** in [sopv(1)](/sopv/1.md)).

- **--not-after=***DATE*

  Do not accept signatures made after the specified *DATE*. Supply *DATE* in ISO-8601 format, preferably in UTC (see **DATE** in [sopv(1)](/sopv/1.md)).

## ARGUMENTS

**sopv verify** looks for OpenPGP signatures in the *SIGNATURES* argument, either as a series of raw OpenPGP signature packets, or as an ASCII-armored series of OpenPGP signature packets. For the signatures to be verified, they must be made by one of the supplied *CERTS* over the message provided on standard input.

Any Invalid or broken signature will be ignored, as will any signature made by an unknown signer.

One or more *CERTS* arguments should point to OpenPGP certificates that would be acceptable signers.

## RETURN CODE

**sopv verify** returns 0 to indicate that at least one valid signature was found.

It may fail for other reasons, but **NO\_SIGNATURE** (3) is a likely failure mode when none of the *SIGNATURES* can be verified as being from any of the *CERTS*.

## AUTHOR

This manual page was written by Daniel Kahn Gillmor. Your implementation of **sopv** is likely written by someone else in alignment with the SOP specification. Please run **sopv version** to learn more about your implementation.

## SEE ALSO

[sopv(1)](/sopv/1.md), [sopv-version(1)](/sopv-version/1.md), [sopv-inline-verify(1)](/sopv-inline-verify/1.md), Stateless OpenPGP Command Line Interface *https://datatracker.ietf.org/doc/draft-dkg-openpgp-stateless-cli/*, RFC 9580 *https://www.rfc-editor.org/rfc/rfc9580.html*