Function verify 

pub fn verify(
    message: &impl ComponentSource,
    signature_input: &str,
    signature: &str,
    verifying_key: &VerifyingKey,
    config: &VerifyConfig,
) -> Result<VerifiedSignature, HttpSigError>

Verifies an HTTP message signature on request.

Reconstructs the signature base from the components named in signature_input (using the received parameter string verbatim, so the base is byte-exact), verifies it against verifying_key, and applies the checks in config. Fails closed on any deviation.

A successful return proves only that the covered components were signed with verifying_key. It does not by itself guarantee any particular component was covered — use VerifyConfig::required_components to require them — nor does it check the message body: if content-digest is covered, the caller MUST also recompute and compare it against the received body with verify_content_digest. Freshness and replay defense (unique nonce / bounded age) are also the caller’s responsibility; see max_age.

Errors

Returns the corresponding HttpSigError for an unparsable field, a label mismatch, a missing covered header, an unexpected alg, a malformed or invalid signature, a missing required component, or a stale, expired, future-dated, or inverted-window signature.