pub fn inspect_release_document(
release_document_path: &Path,
trust: TrustAnchors<'_>,
) -> Result<InspectedRelease>Expand description
Verifies a signed release document against the caller’s trust anchors.
The order is the guarantee. The envelope is shape-checked, then its signature is verified, and only then is the payload interpreted as a release: nothing about the release is believed — not its target, not its paths, not its provenance — until a trusted key has vouched for the exact bytes it was read from.
§Errors
When the anchors cannot be resolved, the document cannot be read, is not a v2 envelope, carries no signature from a trusted key, or describes a release this build cannot accept.