> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dotvibe.app/llms.txt
> Use this file to discover all available pages before exploring further.

# vibe verify

> Verify the Ed25519 signature of a .vibeapp package.

## Synopsis

```
vibe verify <package> --key <pub-key-file> [options]
```

## Description

Recomputes the SHA-256 hash over all package files (sorted by path) and verifies the detached Ed25519 signature against the provided public key. Prints success or a detailed failure reason.

## Arguments

| Argument    | Description                           |
| ----------- | ------------------------------------- |
| `<package>` | Path to the `.vibeapp` file to verify |

## Options

| Flag                     | Description                                                          |
| ------------------------ | -------------------------------------------------------------------- |
| `--key <path>`           | **(required)** Path to the Ed25519 public key file                   |
| `--password <pass>`      | Password for an encrypted package (avoid — visible in shell history) |
| `--password-file <path>` | Read password from a file                                            |
| `-h, --help`             | Print help                                                           |

## Examples

```bash theme={null}
# Verify an unencrypted package
vibe verify myapp.vibeapp --key my-signing.pub

# Verify an encrypted package
vibe verify myapp.vibeapp --key my-signing.pub --password-file secrets/pw.txt
```

## Output

On success:

```
✓ Signature valid
```

On failure:

```
error: signature verification failed — package may have been tampered with
```

## Notes

* Exit code `0` if valid, non-zero if invalid or unsigned
* The macOS host app performs the same verification before launching any package
* Use in CI to gate distribution on verified signatures