#!/bin/bash
# verify-signature.sh <image>@<digest>...: each one is signed with netOrk's key.
#
# The key is cosign.pub beside this script's repository, the one public half of
# the COSIGN_PRIVATE_KEY_B64 secret every image of NetOrk is signed with. A
# reference without a digest is refused: a tag can move after the check.
set -euo pipefail
cd "$(dirname "$0")/.."
[ $# -gt 0 ] || { echo "usage: verify-signature.sh <image>@<digest>..." >&2; exit 2; }
for ref in "$@"; do
  case $ref in *@sha256:*) ;; *) echo "$ref is not pinned by digest" >&2; exit 1 ;; esac
  if ! out=$(cosign verify --key cosign.pub --insecure-ignore-tlog "$ref" 2>&1); then
    echo "$out" >&2
    echo "not signed with netOrk's key: $ref" >&2
    exit 1
  fi
  echo "verified: $ref"
done