Crate verify_trust 

verify-trust: verify a git commit range against the VTC Trust Registry.

For every commit in a range this module answers two questions, in order:

1. Who signed it, cryptographically? The commit’s gpgsig header is parsed as a PROTOCOL.sshsig blob; the Ed25519 public key embedded in it is matched against the keys published in the DID documents of the repository’s declared signers, and the signature is verified over the exact bytes git signed.
2. Is that DID trusted, right now? The signer DID is checked against the Trust Registry with a TRQP authorization query ({entity: signer, authority, action, resource}) via trql-client.

The signer set comes from a committed index file (default .did-signers, one DID per line) that lists identities, not keys — keys are resolved from each DID document at verification time, so key rotation never requires touching the repository, and revoking a signer is a registry operation that takes effect on the next run.

Failure is closed at every layer: an unsigned commit, a signature by an unpublished key, a cryptographically invalid signature, an unauthorized DID, and an unreachable registry all fail the check — each with its own status so an operator can tell which remediation applies.

Signers are reported by agent name where one is available (example.com/@alice) rather than by raw DID. Names come out of the DID documents this crate already resolves, and render through vta_sdk::display_name — the same seam the PNM, CNM and VTC operator surfaces use, so a DID is abbreviated identically wherever it appears.

Modules

pgp_exempt

Exemption keyring for platform-signed commits.

Structs

CommitVerdict

One commit’s verdict, as reported.

ResolvedSigners

The declared signers, resolved: their published keys, why any of them could not be resolved, and what to call them.

TrustReport

The full report for a range.

VerifyTrustArgs

Everything verify-trust needs for one run.

Enums

CommitStatus

Outcome for one commit. Ordered worst-first so a report can sort on it.

SignatureCheck

Result of the cryptographic check for one commit.

Functions

check_commit_signature

Verify one raw commit object against the signer key map.

handle_verify_trust

Run the check end to end: resolve the declared signers’ keys, then verify the range. Returns the process exit code (0 = every commit trusted).

list_commits

List the commits in range, oldest first.

load_signers

Read and parse the signer index: one DID per line, # comments allowed. A missing or malformed file is a hard error — with no declared signers there is nothing to verify against, and the check must not silently pass.

parse_signers

Parse signer-index text. Rejects non-DID entries outright rather than skipping them: a typo must fail loudly, not silently drop a signer.

read_commit_raw

Read one raw commit object.

resolve_signer_keys

Resolve every declared signer DID: collect the Ed25519 keys their DID documents publish, and name each signer from the same document. A DID that fails to resolve is recorded (its commits will fail as unknownKey) without blocking the other signers.

verify_with_keys

Verify the range against an already-resolved signer set. Split from handle_verify_trust so tests can supply keys without a live resolver.