pub fn verify_scoped(repo: &Path, scope: &Path) -> Result<Verification>Expand description
Verify the committed attestation at repo, scoping the “latest code commit”
walk to scope instead of all of repo (#294).
repo and scope serve different roles: repo is where
e2e-attestation.json lives (the package root — a manifest’s own natural
home), while scope is what counts as “code” for freshness (the directory a
path-scoped call actually named, which can be narrower — a package root
commonly also holds tests/, docs, and config files that aren’t the
attestable source). scope must be repo or a descendant of it.
Equivalent to verify_since with base set to None — the walk covers
all reachable history, same as before #319.