Verifies a signed DSO against a trusted-keys directory and reports the result. The exit code carries the verdict.

Synopsis

dso-verify <addon.so> [--keys <trusted-keys.d/>] [--quiet]

Options

Option	Meaning	Default
<addon.so>	The DSO to check (first non-option argument).	—
--keys <dir>	Directory of *.pub PEM Ed25519 keys.	/etc/trusted-keys.d
-q, --quiet	No stdout; use the exit code only.	off
-h, --help	Usage.	—

Output (non-quiet)

TRUSTED: libCircle.so
  name:    circle-plugin
  version: 2.3.1
  author:  Alice <alice@example.com>
  key:     9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
  signed:  2026-09-08T12:00:00Z
  detail:  signature valid; signer key trusted

Exit codes

Code	Level	Meaning
0	TRUSTED	valid signature, signer key in --keys
1	UNKNOWN	valid signature, signer key not in --keys
2	UNSIGNED	no manifest / signature sections
3	REJECTED	signature invalid, or file hash ≠ manifest hash
4	ERROR	file not found, not an ELF object, I/O failure

Examples

# human check
dso-verify libCircle.so --keys /etc/app/trusted-keys.d/

# CI gate — fail the build on anything less than TRUSTED
for so in dist/plugins/*.so; do
    dso-verify "$so" --keys ci/trusted-keys.d/ --quiet \
        || { echo "REJECT $so (code $?)"; exit 1; }
done

# accept TRUSTED or UNKNOWN (staging)
dso-verify "$so" --keys keys.d/ --quiet; rc=$?
[ "$rc" -le 1 ] || exit 1

Notes

• The verification is identical to Verifier::verify — same five steps, same levels. Use the tool for gates and inspection, the library call at load time.
• --quiet still sets the exit code; combine with $? for the level.
• Point --keys at the same directory the host uses so a green CI check means the host will accept it.