atmos plugin verify-public
Usage
atmos plugin verify-public <repository> [--reference <tag-or-digest>] [--digest <expected-digest>]
Without --reference, Atmos checks that GitHub reports an existing GHCR organization package as
public. It uses GH_TOKEN, falling back to GITHUB_TOKEN, for package metadata. It does not create
a package or change its visibility. Missing, private, or unsupported repositories fail this metadata check.
With --reference, Atmos anonymously downloads and verifies the complete OCI graph, including all
platform manifests, configurations, and layers. This audit works with OCI registries beyond GHCR.
Docker credentials and GitHub tokens are not used for anonymous reads. Verification is bounded
and checks content digests; it proves availability and integrity, not publisher identity.
Arguments and flags
repository- OCI repository, optionally prefixed with oci://, without a tag or digest.
--reference- Tag or immutable digest to verify anonymously. Omit for the standalone GHCR visibility metadata check.
--digest- Expected root digest. Requires --reference and fails if the downloaded root differs.
Examples
atmos plugin verify-public oci://ghcr.io/acme/repo-tools
atmos plugin verify-public oci://ghcr.io/acme/repo-tools --reference 1.0.0
atmos plugin verify-public oci://registry.example.com/team/repo-tools --reference sha256:<digest>
For automatic anonymous verification after upload, use plugin publish or
plugin release with --verify-public. Those commands do not require an existing
public package before uploading. See Public packages on GHCR
for the first-upload and visibility-setting flow.
