Verify OPA bundle signature
opa_bundle_verifyRead-onlyIdempotent
Verify the cryptographic signature of a signed OPA bundle to ensure its integrity and detect tampering before policy evaluation.
Instructions
Verify the cryptographic signature of a signed OPA bundle using opa eval --bundle --verification-key. The bundle must have been signed with opa sign (or opa_bundle_sign). OPA checks the .signatures.json manifest inside the bundle against the provided public key before loading any policy -- a tampered or unsigned bundle will fail with INVALID_BUNDLE. Returns { bundle, verified: true } on success.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| bundle | Yes | Path to the signed bundle directory or `.tar.gz` archive. Must be inside an allowed root. | |
| verificationKey | Yes | Path to the PEM file containing the RSA or ECDSA public key, or the path to the HMAC secret file. Must be inside an allowed root. | |
| verificationKeyId | No | Key ID that must match the `keyid` field in the bundle signature. Required when the bundle was signed with `--public-key-id`. | |
| signingAlg | No | Signing algorithm used when the bundle was signed (e.g. `RS256`, `PS256`, `ES256`, `HS256`). Defaults to `RS256`. | |
| scope | No | Expected `scope` value in the bundle signature. Required when the bundle was signed with `--scope`. |