pub fn fetch_verified_binary(
plan: &UpdatePlan,
root_public_key: &[u8],
) -> Result<(Vec<u8>, String), UpdateError>Expand description
Download and verify the successor binary WITHOUT installing it — the running varve verifies its successor against the trust root. Returns the verified binary bytes and the archive digest. Splitting this from the write lets the caller decide on artifact identity before touching disk (varve#38).