Skip to main content
Version: 10

Verify MoveIt Pro Release Signatures

Required Version
This feature will not be released until MoveIt Pro version 10.2.0.

PickNik signs every MoveIt Pro release artifact with Sigstore when the release pipeline publishes it. A valid signature shows that the file or image was signed by one of the release workflows in the PickNikRobotics/moveit_pro repository, running on that release's tag, and that it has not changed since. The signatures are keyless, so there is no PickNik public key to download: cosign checks each signature against a short-lived certificate that names the workflow, and against the public Rekor transparency log.

Install cosign 3.0 or later before running the commands below; the commands rely on its defaults for the Sigstore bundle format. Replace <VERSION> with the release you downloaded, for example 10.2.0.

The expected identity​

Every command on this page passes the same two checks. A signature passes only when both match:

--certificate-oidc-issuer https://token.actions.githubusercontent.com
--certificate-identity-regexp '^https://github\.com/PickNikRobotics/moveit_pro/\.github/workflows/(publish-runtime|lane-runtime|build-core-debians|publish-license-cli|stage-desktop-app)\.yaml@refs/tags/<VERSION>$'

Escape the dots in the version, so 10.2.0 becomes 10\.2\.0 in the regular expression.

Packages and archives​

Each MoveIt Pro installer .deb and .rpm, MoveIt Pro Core archive, and moveit-pro-license package on download.picknik.ai has a Sigstore bundle beside it, at the same URL with .sigstore.json appended. The bundles are also attached to the release's GitHub Release.

For example, to verify the installer .deb:

curl -fLO https://download.picknik.ai/moveit-pro/moveit-pro-<VERSION>-any.deb
curl -fLO https://download.picknik.ai/moveit-pro/moveit-pro-<VERSION>-any.deb.sigstore.json
cosign verify-blob \
  --bundle moveit-pro-<VERSION>-any.deb.sigstore.json \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github\.com/PickNikRobotics/moveit_pro/\.github/workflows/(publish-runtime|lane-runtime|build-core-debians|publish-license-cli|stage-desktop-app)\.yaml@refs/tags/<VERSION>$' \
  moveit-pro-<VERSION>-any.deb

cosign prints Verified OK and exits with status 0 when the signature is valid. Install nothing that fails this check.

Desktop App installers​

The MoveIt Pro Desktop App installers share one signed checksum file, moveit-pro-desktop-<VERSION>-SHA256SUMS. Verify the checksum file, then check your installer against its own line in it. Set installer to the file name you downloaded:

curl -fLO https://download.picknik.ai/desktop/moveit-pro-desktop-<VERSION>-SHA256SUMS
curl -fLO https://download.picknik.ai/desktop/moveit-pro-desktop-<VERSION>-SHA256SUMS.sigstore.json
installer=moveit-pro-desktop-<VERSION>-<os>-<arch>.<deb|rpm>
cosign verify-blob \
  --bundle moveit-pro-desktop-<VERSION>-SHA256SUMS.sigstore.json \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github\.com/PickNikRobotics/moveit_pro/\.github/workflows/(publish-runtime|lane-runtime|build-core-debians|publish-license-cli|stage-desktop-app)\.yaml@refs/tags/<VERSION>$' \
  moveit-pro-desktop-<VERSION>-SHA256SUMS &&
  awk -v file="${installer}" '$2 == file' moveit-pro-desktop-<VERSION>-SHA256SUMS | sha256sum --check --strict -

Run it in the directory that holds the installer. The checksum check runs only if cosign verifies the checksum file. It prints <installer>: OK only when the checksum file lists the installer's exact name and its digest matches. An installer the checksum file does not list fails with no properly formatted checksum lines found.

Docker images​

The MoveIt Pro Runtime images on Docker Hub, picknikciuser/moveit-pro, carry their signatures in the same repository. A tag can be moved, so resolve it to a digest once, then verify that digest and pull it only if verification succeeds:

image=picknikciuser/moveit-pro
digest="$(docker buildx imagetools inspect --format '{{.Manifest.Digest}}' "${image}:<VERSION>-jazzy")"
cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github\.com/PickNikRobotics/moveit_pro/\.github/workflows/(publish-runtime|lane-runtime|build-core-debians|publish-license-cli|stage-desktop-app)\.yaml@refs/tags/<VERSION>$' \
  "${image}@${digest}" &&
  docker pull "${image}@${digest}"

Use the tag your installation runs, including any GPU suffix. Both the multi-architecture tag and each per-architecture image are signed.

Images tagged main are signed too, by workflows running on refs/heads/main. Verify those with @refs/heads/main in place of @refs/tags/<VERSION>.