# Promethix Cosign Verification

This directory publishes public verification material only. No private key
material is stored here.

## Public Key

- `promethix-code-signing.pub`
- `promethix-code-signing.pub.sha256`

Verify the downloaded key:

```sh
curl -fsSLO https://trust.promethix.dev/cosign/promethix-code-signing.pub
curl -fsSLO https://trust.promethix.dev/cosign/promethix-code-signing.pub.sha256
sha256sum -c promethix-code-signing.pub.sha256
```

## Verify a Promethix Image

Verify a signed image by digest:

```sh
cosign verify \
  --key https://trust.promethix.dev/cosign/promethix-code-signing.pub \
  ghcr.io/promethixlabs/cloudflare-tunnel-operator@sha256:<digest>
```

Verify with an expected repository annotation:

```sh
cosign verify \
  --key https://trust.promethix.dev/cosign/promethix-code-signing.pub \
  -a repo=github.com/gentoorax/Promethix.Operator.CloudflareRouter \
  ghcr.io/promethixlabs/cloudflare-tunnel-operator@sha256:<digest>
```

The same public key can also be used for Promethix-signed images published
to other registries.