Skip to main content

​
Synopsis

vibe verify <package> --key <pub-key-file> [options]

​
Description

Recomputes the SHA-256 hash over all package files (sorted by path) and verifies the detached Ed25519 signature against the provided public key. Prints success or a detailed failure reason.

​
Arguments

ArgumentDescription
<package>Path to the .vibeapp file to verify

​
Options

FlagDescription
--key <path>(required) Path to the Ed25519 public key file
--password <pass>Password for an encrypted package (avoid — visible in shell history)
--password-file <path>Read password from a file
-h, --helpPrint help

​
Examples

# Verify an unencrypted package
vibe verify myapp.vibeapp --key my-signing.pub

# Verify an encrypted package
vibe verify myapp.vibeapp --key my-signing.pub --password-file secrets/pw.txt

​
Output

On success: 
✓ Signature valid
On failure: 
error: signature verification failed — package may have been tampered with

​
Notes

  • Exit code 0 if valid, non-zero if invalid or unsigned
  • The macOS host app performs the same verification before launching any package
  • Use in CI to gate distribution on verified signatures