Struct VerifyTrustArgs 

pub struct VerifyTrustArgs {
    pub repo_dir: PathBuf,
    pub range: String,
    pub max_signers: usize,
    pub registry_url: Option<String>,
    pub registry_did: String,
    pub vtc_did: String,
    pub action: String,
    pub resource: String,
    pub fallback_resource: Option<String>,
    pub exempt_keyring: Option<PathBuf>,
    pub resolve_agent_names: bool,
    pub json: bool,
}

Everything verify-trust needs for one run.

Fields

repo_dir: PathBuf

Repository to verify (a working tree with git available).

range: String

Commit range in git rev-list syntax, e.g. origin/main..HEAD.

max_signers: usize

Ceiling on the number of distinct DIDs a range may claim, each of which costs one resolution.

The signer set is derived from the commits, so a pull request chooses which identifiers CI resolves — and for the network-resolved methods (did:web, did:webvh) that means an outbound fetch to a host the author picked. Distinct DIDs are deduplicated first; this bounds what remains. Exceeding it fails the run rather than resolving anyway.

registry_url: Option<String>

Base URL of the Trust Registry (POST <url>/trust-tasks).

None until discovery fills it in from registry_did’s DID document; set explicitly to override discovery (a local or dev registry that publishes no service endpoint). verify_prepared requires it resolved — handle_verify_trust does that before calling.

Prefer discovery. Over the HTTPS binding the registry’s answer is not signed — registry_did is only stamped on the outgoing request as recipient — so trust in “is this DID authorized” rests on reaching the right host. Deriving the URL from the DID document makes the endpoint inherit that DID’s integrity instead of being a second, independently mutable value that nothing cross-checks.

registry_did: String

DID of the registry (the recipient on every query document, and what the endpoint is discovered from).

vtc_did: String

DID of the VTC — the community whose authority the trust tuple is evaluated under, sent as TRQP’s authority_id.

action: String

TRQP action, e.g. git.commit.sign.

resource: String

TRQP resource, e.g. the org/repo slug.

With no committed signer index, this is the only thing scoping a signer to this repository: a grant is accepted exactly when the registry authorizes the tuple under this resource (or the fallback). Treat it as security-relevant configuration.

fallback_resource: Option<String>

Broader resource to try when the primary one does not authorize (e.g. the org for an org-wide grant). Grant semantics are resource OR fallback: the registry’s wire contract cannot distinguish “no record” from an explicit authorized: false, so a repo-level record cannot veto an org-level grant.

exempt_keyring: Option<PathBuf>

Optional armored PGP keyring of exempt platform keys (e.g. GitHub’s web-flow key); relative paths resolve against repo_dir. Absent means no exemptions: every PGP-signed commit fails.

resolve_agent_names: bool

Round-trip the agent names the signers’ DID documents claim, so a verified name renders unqualified instead of tagged [unverified].

Costs one outbound HTTPS fetch per claimed name, to a host the document’s author chose, so it is opt-in — the same rule the PNM and CNM CLIs apply to their --resolve-agent-names flag. With it off the claims still show (they come free with the documents this crate must resolve anyway), but as the self-assertions they are.

json: bool

Emit machine-readable JSON on stdout instead of human lines.

Trait Implementations

impl Clone for VerifyTrustArgs

fn clone(&self) -> VerifyTrustArgs

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for VerifyTrustArgs

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.