Function inspect_box_archive 

pub fn inspect_box_archive(
    release_document_path: &Path,
    trust: TrustAnchors<'_>,
    archive_override: Option<&Path>,
) -> Result<InspectedArchive>

Performs the complete read-only trust chain, archive included.

Keeping this as one operation matters: an execution API must not create a second, subtly different interpretation of a signed release. The caller receives validated in-memory objects and the exact archive path, while extraction and execution remain separate steps.

Errors

When the release fails inspection, the archive is missing or does not match its signed size and hash, the archive holds an entry the format forbids, or box.json disagrees with the release.