pub fn inspect_release_document(
release_document_path: &Path,
public_key_path: &Path,
) -> Result<InspectedRelease>Expand description
Verifies a signed release document against a caller-supplied trust file.
The order is the guarantee. The envelope is shape-checked, then its signature is verified, and only then is the payload interpreted as a release: nothing about the release is believed — not its target, not its paths, not its provenance — until a trusted key has vouched for the exact bytes it was read from.
§Errors
When the document cannot be read, is not a v2 envelope, carries no signature from a trusted key, or describes a release this build cannot accept.