Module selfverify 

Self-verification (REQ-SELF-001, DD-009) — the tool that gates the toolchain clears its own gate.

varve releases carry a varve-native signature: a DSSE envelope over the release’s SHA256SUMS.txt, signed with the same root key deposits use. varve self-verify checks a candidate archive against that envelope with the pinned trust root, fully offline, failing closed — including when the envelope is absent, because “unsigned” is a verdict, not a shrug.

Enums

SelfVerifyError

Constants

RELEASE_SUMS_PAYLOAD_TYPE

The authenticated payload type for release checksum envelopes.

Functions

sign_release_sums

Sign a SHA256SUMS.txt into the release envelope (the CI side).

verify_release_file

Verify one release file against the signed sums envelope. Returns the verified digest on success.