# atmos plugin verify-public

Check public package visibility or verify anonymous access to an OCI release.

> ⚠️ Experimental

## Usage

```shell
atmos plugin verify-public <repository> [--reference <tag-or-digest>] [--digest <expected-digest>]
```

Without `--reference`, Atmos checks that GitHub reports an existing GHCR organization package as
public. It uses `GH_TOKEN`, falling back to `GITHUB_TOKEN`, for package metadata. It does not create
a package or change its visibility. Missing, private, or unsupported repositories fail this preflight.

With `--reference`, Atmos anonymously downloads and verifies the complete OCI graph, including all
platform manifests, configurations, and layers. This audit works with OCI registries beyond GHCR.
Docker credentials and GitHub tokens are not used for anonymous reads. Verification is bounded
and checks content digests; it proves availability and integrity, not publisher identity.

## Arguments and flags

- **repository**
  OCI repository, optionally prefixed with oci://, without a tag or digest.
- **--reference**
  Tag or immutable digest to verify anonymously. Omit for the GHCR visibility preflight.
- **--digest**
  Expected root digest. Requires --reference and fails if the downloaded root differs.

## Examples

```shell
atmos plugin verify-public oci://ghcr.io/acme/repo-tools
atmos plugin verify-public oci://ghcr.io/acme/repo-tools --reference 1.0.0
atmos plugin verify-public oci://registry.example.com/team/repo-tools --reference sha256:<digest>
```

For a publication that requires both the preflight and post-upload verification, use
[plugin publish](publish.mdx) or [plugin release](release.mdx) with `--verify-public`.