Struct Verifier 

pub struct Verifier { /* private fields */ }

Holds trusted public keys and verifies DSSE envelopes against them.

Separate from Signer — signing requires a private key, verification requires only public keys. Verifiers are cheap to clone and pass around.

Implementations

impl Verifier

pub fn new(keys: HashMap<String, VerifyingKey>) -> Self

Creates a Verifier with the given trusted key map.

pub fn from_signer(signer: &Ed25519Signer) -> Self

Convenience: creates a single-key Verifier from an Ed25519Signer. Most useful in tests and local-only workflows.

pub fn add_key(&mut self, key_id: impl Into<String>, pub_key: VerifyingKey)

Adds a trusted public key.

pub fn verify(&self, envelope: &Envelope) -> Result<VerifyResult, VerifyError>

Verifies all signatures in the envelope.

Returns Ok(VerifyResult) only if every signature in the envelope is valid and its key is trusted. Any unknown key or invalid signature returns Err.

Use this for strict verification where all listed signers must be valid (e.g., hybrid Ed25519 + ML-DSA in v2 where both are required).

pub fn verify_any( &self, envelope: &Envelope, ) -> Result<VerifyResult, VerifyError>

Verifies that at least one signature in the envelope is valid from a trusted key. Signatures from unknown keys are skipped.

Use this during key rotation when old and new keys may coexist, or when accepting envelopes from multiple possible signers.

Trait Implementations

impl Clone for Verifier

fn clone(&self) -> Verifier

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.