Module bundle 

Cosign bundle helper for model cards.

Wraps chio_attest_verify::SigstoreVerifier::verify_bundle so that callers presenting a (card_bytes, bundle_json) pair can verify the bundle without reaching into sigstore-rs directly. The model-card binding does not introduce a new trust root or a new signature path; the existing cosign bundle verifier (and the PQ-hybrid surface) is consumed verbatim.

Trust contract

• card_bytes MUST be the RFC 8785 canonical-JSON encoding of the crate::card::ModelCard. The cosign bundle’s signature is taken over those bytes, so re-encoding through any non-canonical serializer produces a different digest and the bundle rejects fail-closed.
• expected is an ExpectedIdentity supplied by the caller. The helper does not synthesise a default identity; deployments that flip policy.weights_card_required = required_with_pin provide the SAN regex from the provider matrix.
• now is the verifier-side current time used to enforce the card’s expires_at. The cosign verifier’s certificate-window check is independent of this and runs against the cert’s notBefore / notAfter.

Trust boundary

Every public method that returns Ok(_) MUST mean:

1. the cosign bundle verified against the supplied card bytes,
2. the bundle’s certificate identity matched ExpectedIdentity and its OIDC issuer matched ExpectedIdentity::certificate_oidc_issuer,
3. the card decoded cleanly from the canonical bytes, and
4. the card’s expires_at is strictly after now.

Any failing precondition surfaces as a crate::error::WeightsError.

Structs

VerifiedModelCard

Successful verification result. Pairs the parsed ModelCard with the upstream VerifiedAttestation so receipt consumers can correlate the Rekor log index, the Fulcio identity, and the model card’s logical fields without re-parsing the bundle.

Functions

verify_model_card_bundle

Verify a cosign-signed model card. Delegates the cryptographic verify path to AttestVerifier::verify_bundle; this helper does not fork it.