Verify and sign

tine verify always checks the artifact digest. When key options are supplied it also verifies the required signature and fails closed.

tine verify <run_id> [--key-env NAME | --key-file PATH | --pubkey PATH]

Machine-readable verification

tine verify result.tine --json
tine verify result.tine --pubkey signing.pub --require-signature --json

Introduced in v0.5, --json emits exactly one object containing ok, the integrity result, and the signature result when signature checking was armed. A failed integrity or authenticity check, including an unreadable target, emits "ok": false and exits 1. A failure that prevents the check itself, such as an unreadable key file, remains human-readable and nonzero, so automation must inspect both the object and process status.

HMAC-SHA256

HMAC support uses the standard library. The verifier and signer share the same secret.

export TINE_KEY="a-secret-at-least-16-bytes-long"
tine sign result.tine --key-env TINE_KEY --key-id prod
tine verify result.tine --key-env TINE_KEY

Ed25519

Ed25519 separates the private signing key from the public verification key. Cryptography has been a core dependency since 0.3; the [crypto] extra remains only as a compatibility alias.

tine keygen --out signing.key --pub signing.pub
tine sign result.tine --algorithm ed25519 --ed25519-key-file signing.key
tine verify result.tine --pubkey signing.pub

Overwrite controls

# Refuses if signed-copy.tine already exists
tine sign result.tine --key-env TINE_KEY --save signed-copy.tine

# Destination overwrite is explicit and separate from integrity bypass
tine sign result.tine --key-env TINE_KEY --save signed-copy.tine --overwrite

# Key generation also refuses existing files unless --force is explicit
tine keygen --out signing.key --pub signing.pub --force

sign --overwrite only controls the --save destination. The separate sign --force flag means “sign despite a failed integrity check”; neither flag implies the other. keygen also refuses the same path for --out and --pub.

Trust boundary

The signature commits to artifact content, not the stored digest. New v0.4 signatures cover metadata.fork, while the descriptive metadata.fork_reason remains unsigned for v0.3 compatibility. Mutable tags remain outside the signed payload, but commands that re-save an artifact, including tag and migrate, remove its attached signature; review the warning and re-sign. Signing is limited to completed or failed artifacts. A key ID or signer label is display metadata, not proof of identity; distribute trusted keys through your own secure channel.