Skip to main content

verify_evidence_record

confium_transparency::ers

Function verify_evidence_record 

Source 
pub fn verify_evidence_record(
    record: &EvidenceRecord,
    artifact: &[u8],
    trusted_tsas: &[Tsa],
) -> Result<ErsVerificationResult, ErsError>
Expand description

Verify an Evidence Record end-to-end against the artifact it protects and the set of trusted TSAs.

Checks, per RFC 4998 as realized by this data model:

  1. digest_algorithms.len() matches the sequence count.
  2. Every sequence’s hashed_message equals the digest of artifact under that sequence’s declared algorithm (each renewal re-hashes the same artifact under a stronger hash).
  3. Every time_stamp.tsa_id is in trusted_tsas.
  4. applied_at timestamps are non-decreasing across sequences.

Sequences using algorithms whose digests don’t fit the model’s 32-byte fields (SHA-384/512, SHA3-256) are reported as unsupported — see ErsError::UnsupportedAlgorithm — rather than being silently skipped or truncated.