Crate verify_trust 

verify-trust: verify a git commit range against the VTC Trust Registry.

For every commit in a range this module answers two questions, in order:

1. Who signed it, cryptographically? The commit names a DID on its committer header; that DID is resolved, its document must publish the Ed25519 key embedded in the commit’s sshsig, and the signature must verify over the exact bytes git signed.
2. Is that DID trusted, right now? The signer DID is checked against the Trust Registry with a TRQP authorization query ({entity: signer, authority, action, resource}) via trql-client, where authority is the VTC’s DID — the community the tuple is evaluated under.

The registry’s endpoint is discovered from its DID document rather than configured alongside it: resolve_registry_endpoint picks the highest-preference transport both sides support (TSP, then DIDComm, then HTTPS). Over the HTTPS binding the registry’s answer carries no signature — the registry DID is only stamped on the outgoing request as recipient — so the endpoint is what the answer’s trustworthiness rests on, and deriving it from the DID document keeps it bound to an identifier with integrity behind it.

The signer set is derived from the commits themselves — there is no per-repository allowlist. The committer header is author-controlled text, so it is treated strictly as a lookup hint: the claim is only ever as good as the two checks that follow it. A commit claiming a DID it cannot sign for fails step 1 (the DID does not publish the signing key, or the signature does not verify over a payload that includes the claim itself); a commit signed by a DID nobody enrolled fails step 2.

That places every question of who may sign here in the registry, where enrolment, rotation and revocation already live. --resource is consequently the only thing scoping a signer to this repository, and is security-relevant input: widening it, or widening --fallback-resource, widens who may sign, with nothing in the repository to contradict it.

Failure is closed at every layer: an unsigned commit, a committer naming no DID, a DID that will not resolve, a signature by a key that DID does not publish, a cryptographically invalid signature, an unauthorized DID, and an unreachable registry all fail the check — each with its own status so an operator can tell which remediation applies.

Signers are reported by agent name where one is available (example.com/@alice) rather than by raw DID. Names come out of the DID documents this crate already resolves, and render through vta_sdk::display_name — the same seam the PNM, CNM and VTC operator surfaces use, so a DID is abbreviated identically wherever it appears.

Modules

pgp_exempt

Exemption keyring for platform-signed commits.

Structs

CommitVerdict

One commit’s verdict, as reported.

RangeCommit

One commit of the range, read once so the object is not fetched again for the claim pass and the verification pass.

ResolvedSigners

The DIDs a range claimed, resolved: the keys each publishes, why any of them could not be resolved, and what to call them.

TrustReport

The full report for a range.

VerifyTrustArgs

Everything verify-trust needs for one run.

Enums

CommitStatus

Outcome for one commit. Ordered worst-first so a report can sort on it.

SignatureCheck

Result of the cryptographic check for one commit.

Functions

build_resolver

Build the DID resolver used for both the registry endpoint and the signers.

check_commit_signature

Verify one raw commit object against the resolved signers.

claimed_signer_dids

The distinct DIDs the range’s commits claim on their committer headers.

handle_verify_trust

Run the check end to end: discover the registry endpoint, collect the DIDs the range claims, resolve them, then verify. Returns the process exit code (0 = every commit passes).

list_commits

List the commits in range, oldest first.

read_commit_raw

Read one raw commit object.

read_range

Read every commit object in the range, oldest first.

resolve_registry_endpoint

Discover the Trust Registry’s endpoint from its DID document.

resolve_signer_keys

Resolve every DID the range claimed: collect the Ed25519 keys their documents publish, and name each signer from the same document. A DID that fails to resolve is recorded (its commits fail as unresolvedSigner) without blocking the others.

verify_prepared

Verify commits already read and resolved. Split from handle_verify_trust so tests can supply keys without a live resolver.