skills.rest
Nightreaver
NightreaverCOMMUNITY
Explore all skills by this author →
GitHub

ssh-verify-signature

Verify GPG, cosign, and minisign signatures on SSH-deployed artifacts.

6|Updated Apr 17, 2026
Search Tags:#SSH#GPG#cosign#artifact verification#signature checking#minisign
One-click install
npx skills add https://github.com/Nightreaver/python-ssh-mcp --skill ssh-verify-signature
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ssh-verify-signature
Source: https://github.com/Nightreaver/python-ssh-mcp/tree/main/runbooks/ssh-verify-signature
Command: npx skills add https://github.com/Nightreaver/python-ssh-mcp --skill ssh-verify-signature

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill ensures the integrity of remote artifacts on SSH targets by verifying their signatures, thus preventing unauthorized modifications and maintaining supply-chain integrity.

Core Features & Use Cases

  • Artifact Verification: Validate GPG, cosign, and minisign signatures against artifacts already deployed on SSH targets.
  • Configured Execution: Uses ssh_exec_run to execute command-allowlisted binary verifiers (GPG, cosign, minisign).
  • Out-of-Band Pubkey Distribution: Enforces distribution of pubkeys from trusted sources outside of the repository, minimizing risk.
  • Prerequisites: Requires ALLOW_DANGEROUS_TOOLS, target-side binary presence, and configured command_allowlist in hosts.toml.

Quick Start

Use the 'ssh-verify-signature' skill to verify the signature of the artifact '/opt/app/releases/v1.2.3.tar.gz' on host 'deploy-target'.

Frequently Asked Questions about ssh-verify-signature

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify the signature of a remote artifact on an SSH target?▼

To verify remote artifact signatures via SSH, the skill executes command-allowlisted verifier tools on the target host to validate deployed files, requiring target-side binary presence and command_allowlist configuration in hosts.toml.

What signature formats are supported for SSH artifact verification?▼

SSH artifact verification supports GPG, cosign, and minisign signature formats, allowing validation of software updates and deployment pipeline artifacts against trusted pubkeys distributed out-of-band.

Do I need special permissions to run GPG or cosign verification over SSH?▼

Yes, running GPG or cosign verification over SSH requires the ALLOW_DANGEROUS_TOOLS permission, target-side binary presence, and configured command_allowlist in hosts.toml to execute the verification safely.

How does out-of-band pubkey distribution work for remote SSH signature checks?▼

Out-of-band pubkey distribution for SSH signature checks requires fetching pubkeys from trusted sources outside the repository, minimizing the risk of unauthorized modifications and maintaining supply-chain integrity.

Can I use this SSH signature verification for post-deployment integrity checks?▼

Yes, SSH signature verification is applicable for post-deployment artifact integrity checks, validating the authenticity of files already deployed on SSH targets to prevent unauthorized modifications.

Why does remote signature verification fail without a command allowlist?▼

Remote signature verification fails without a command allowlist because the skill uses ssh_exec_run to execute only command-allowlisted binary verifiers, ensuring no unauthorized commands run on the SSH target.

Related Skills

Explore More Software Engineering Skills→
RedHatProductSecurityRedHatProductSecurity
47

software-signing

Sign and verify container images, binaries, and packages with Sigstore Cosign and GPG.

Official
Intermediate
sgcarstrendssgcarstrends
21

deployment-rollback

Roll back failed deployments across environments using SST, AWS CLI, and Git.

Official
Advanced
AirmomoAirmomo

ssh-essentials

Manage SSH keys, tunnels, and file transfers with OpenSSH tools.

Community
Intermediate
vince-winkintelvince-winkintel
43

glab-attestation

Verify software attestations for artifacts in GitLab projects using glab.

Community
Intermediate