Module verify_attest 

mkit verify-attest — verify every attestation attached to a commit.

mkit verify-attest [--commit <hash>] [--trust-roots <path>]
                   [--algorithm <filter>]

Trust-roots file (TOML, simple flat schema):

[[trust_root]]
keyid = "ed25519:..."
kind  = "ed25519"
pubkey_hex = "..."

• kind is one of ed25519, secp256k1 (alias secp256k1-sec1), p256-sec1 (alias p256), or bls12381-thr. Anything else is ignored.
• algorithm is accepted as an alias for kind (per docs/specs/SPEC-RELEASE-THRESHOLD.md); either field name works.
• pubkey_hex is the raw public key bytes in lowercase hex. For bls12381-thr, the bytes are the 96-byte G2 compressed aggregated cohort public key (the MinSig variant).

Exit code is 0 iff every listed attestation is bound to the requested commit and has any_verified = true, nonzero otherwise.

--format=json emits one JSON object to stdout describing the outcome (in addition to the stderr prose report above, which stays unconditional):

{
  "ok": <bool>,
  "commit": "<64-hex>",
  "error": "<string>|null",
  "attestations": [
    {
      "id": "<64-hex>|null",
      "error": "<string>|null",
      "signatures": [
        {"keyid": "...", "algorithm": "<string>|null", "verified": <bool>, "reason": "<string>|null"}
      ]
    }
  ]
}

error at the attestation level covers read/decode/subject-mismatch failures (in which case signatures is empty); error at the top level is set whenever ok is false.

Functions

run