Function verify_reader 

pub fn verify_reader(
    reader: impl Read,
    max_bytes: u64,
    expected: Sha256Digest,
) -> Result<ArtifactIdentity, ArtifactError>

Verify a complete bounded stream before the caller extracts or uses its bytes.

Errors

Returns read/limit failures or a typed mismatch with the observed identity.