Module verify 

Proves the freeze registry against operator public keys on this machine.

freeze list --verify-signatures reads the registry from a broker and then checks every entry here, against a trust set on the operator’s own disk. That is what makes the operator’s laptop, and not the broker that served the rows, the thing that says the registry is authentic. A broker that minted a record naming somebody else cannot make a signature to go with it, because the signing key never reached it.

What a proof is worth

A verified entry proves authorship. It proves that the person the entry names authored that entry, for that scope, in that cluster, at that time. It does not prove that any broker then refused a write, which is a different kind of evidence that the produce-path tests supply.

The mixture

freeze.require_signature is off by default, because a freeze is the safe direction and an operator has to reach it in one command on a cluster where nobody installed key material yet. So a registry can hold proved entries and attested ones side by side. An attested entry carries no signature, and the broker’s word is all that stands behind it.

This is what --verify-signatures separates, so an unsigned entry is reported as unsigned rather than counted as a failure. An operator who wants the mixture gone sets freeze.require_signature = true on the brokers.

Three outcomes, not two

An entry that names a key_id the local trust set does not hold is not the same as an entry whose signature is wrong. The first says the tool could not check. The second says the tool checked and the answer is wrong. KFC-5’s verifier draws the same line, and the caller turns the two into different exit codes.

Structs

CheckedEntry

One registry entry, and what the local trust set says about it.

VerifyOutcome

What one --verify-signatures pass found.

Enums

Unproved

Why one registry entry is not proved.

Functions

load_trust_set

Read a trust set from a TOML file that carries [[operator_keys]] entries.

verify_registry

Check every returned registry entry against the local trust set.