mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
0ff130ed84
Add a tool that can be used to verify if a given IBM host-key document is valid. This uses the same logic (and code) as the image/request tools for IBM Secure Execution, pvimg, pvattest, and pvsecret. This tool basically just does the first step of the above tools; but without creating any request or image. Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com> Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
77 lines
1.7 KiB
Groff
77 lines
1.7 KiB
Groff
.\" Copyright IBM Corp. 2025
|
|
|
|
.TH "PVVERIFY" "1" "2025-12-09" "s390-tools" "Pvverify Manual"
|
|
.nh
|
|
.ad l
|
|
.SH NAME
|
|
pvverify \- Tool to verify host-keys
|
|
.SH SYNOPSIS
|
|
.nf
|
|
.fam C
|
|
pvverify [OPTIONS] --host-key-document <FILE> <--no-verify|--cert <FILE>>
|
|
.fam C
|
|
.fi
|
|
.SH DESCRIPTION
|
|
Tool to verify host\-keys. Use this tool to verify the chain of trust for IBM
|
|
Secure
|
|
.SH OPTIONS
|
|
|
|
.PP
|
|
\-k, \-\-host\-key\-document <FILE>
|
|
.RS 4
|
|
Use FILE as a host\-key document. Can be specified multiple times and must be
|
|
specified at least once.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-\-no\-verify
|
|
.RS 4
|
|
Disable the host\-key document verification. Does not require the host\-key
|
|
documents to be valid. Do not use for a production request unless you verified
|
|
the host\-key document beforehand.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-C, \-\-cert <FILE>
|
|
.RS 4
|
|
Use FILE as a certificate to verify the host\-key or keys. The certificates are
|
|
used to establish a chain of trust for the verification of the host\-key
|
|
documents. Specify this option twice to specify the IBM Z signing key and the
|
|
intermediate CA certificate (signed by the root CA).
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-\-crl <FILE>
|
|
.RS 4
|
|
Use FILE as a certificate revocation list (CRL). The list is used to check
|
|
whether a certificate of the chain of trust is revoked. Specify this option
|
|
multiple times to use multiple CRLs.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-\-offline
|
|
.RS 4
|
|
Make no attempt to download CRLs.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-\-root\-ca <ROOT_CA>
|
|
.RS 4
|
|
Use FILE as the root\-CA certificate for the verification. If omitted, the
|
|
system wide\-root CAs installed on the system are used. Use this only if you
|
|
trust the specified certificate.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-\-version
|
|
.RS 4
|
|
Print version information and exit.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-h, \-\-help
|
|
.RS 4
|
|
Print help (see a summary with \fB\-h\fR).
|
|
.RE
|
|
.RE
|