Expand description
mkit verify <rev> — verify the signature on a commit, remix, or
signed tag.
mkit verify <rev> [--trusted] [--trust-roots <path>]By default mkit verify only proves that the object’s own embedded
signer public key produced the attached signature — it does NOT
check that key against any allow-list, so a signature from a freshly
generated attacker key verifies exactly the same as one from a key
the caller actually trusts (issue #693). Passing --trusted (or
--trust-roots <path>) additionally cross-checks signer against
the trust-roots registry mkit trust add/list/remove manages
(commands/trust_roots.rs), failing closed — exit code
exit::DATAERR — when the signer is not on the list, even if the
cryptographic signature itself is valid.
--trust-roots defaults to the user-scoped
$XDG_CONFIG_HOME/mkit/trust-roots.toml; an in-repo path is refused
unless passed explicitly (same hostile-clone defense as
verify-attest, see docs/THREAT-MODEL.md §5).