Function verify

verify(
    message: unknown,
    policy: unknown,
    options: unknown,
): Promise<
    Result<
        Readonly<
            {
                authorization: "not_evaluated";
                content: | Readonly<
                    {
                        bytes: number;
                        checked: readonly string[];
                        kind: "content-digest"
                        | "repr-digest";
                        unsupported: readonly string[];
                    },
                >
                | "not_required";
                freshness: | "not_evaluated"
                | Readonly<
                    {
                        created: number
                        | null;
                        expires: number | null;
                        maxAge: number | null;
                        now: number;
                        skew: number;
                    },
                >;
                label: string;
                principal: | "unattributed"
                | Readonly<
                    {
                        identifier: string;
                        kind: "agent";
                        origin: string;
                        provenance: Readonly<
                            {
                                fetchedAt: number;
                                proof: Proof;
                                revision: string
                                | null;
                                sourceType: "directory" | "jwks_uri" | "cimd";
                            },
                        >;
                        thumbprint: string;
                        type: "directory"
                        | "jwks_uri"
                        | "cimd";
                    },
                >
                | Readonly<{ kind: "key"; thumbprint: string }>;
                profile:
                    | Readonly<
                        {
                            name: "web_bot_auth";
                            revision: "draft-ietf-webbotauth-httpsig-protocol-00";
                        },
                    >
                    | Readonly<{ name: "rfc9421" }>
                    | ProfileStamp<never>;
                replay:
                    | Readonly<{ retainUntil: number; store: string }>
                    | "not_required";
                signature: Readonly<
                    {
                        algorithm: SigningAlgorithm;
                        covered: readonly (readonly [(...), (...)])[];
                        crypto: "valid";
                        keyid: string | null;
                        parameters: Parameters;
                    },
                >;
            },
        >,
    >,
>
Verify one HTTP signature under an explicit branded policy.

Checks exactly the named label; it never tries other labels. Success means the cryptography, coverage, freshness, content, and replay layers all passed. It does not authorize: the Verification records authorization: "not_evaluated".
Parameters
- message: unknown
  A branded Message carrying the signature.
- policy: unknown
  A branded Policy from Policy.create.
- options: unknown
  {label, context?, representation?, digestState?}. representation is a complete retained Body and needs a "representation" content policy. digestState is a DigestState of the policy's content kind that you fed with a streamed body; verify finishes it. The two are mutually exclusive.
Returns Promise<
    Result<
        Readonly<
            {
                authorization: "not_evaluated";
                content: | Readonly<
                    {
                        bytes: number;
                        checked: readonly string[];
                        kind: "content-digest"
                        | "repr-digest";
                        unsupported: readonly string[];
                    },
                >
                | "not_required";
                freshness: | "not_evaluated"
                | Readonly<
                    {
                        created: number
                        | null;
                        expires: number | null;
                        maxAge: number | null;
                        now: number;
                        skew: number;
                    },
                >;
                label: string;
                principal: | "unattributed"
                | Readonly<
                    {
                        identifier: string;
                        kind: "agent";
                        origin: string;
                        provenance: Readonly<
                            {
                                fetchedAt: number;
                                proof: Proof;
                                revision: string
                                | null;
                                sourceType: "directory" | "jwks_uri" | "cimd";
                            },
                        >;
                        thumbprint: string;
                        type: "directory"
                        | "jwks_uri"
                        | "cimd";
                    },
                >
                | Readonly<{ kind: "key"; thumbprint: string }>;
                profile:
                    | Readonly<
                        {
                            name: "web_bot_auth";
                            revision: "draft-ietf-webbotauth-httpsig-protocol-00";
                        },
                    >
                    | Readonly<{ name: "rfc9421" }>
                    | ProfileStamp<never>;
                replay:
                    | Readonly<{ retainUntil: number; store: string }>
                    | "not_required";
                signature: Readonly<
                    {
                        algorithm: SigningAlgorithm;
                        covered: readonly (readonly [(...), (...)])[];
                        crypto: "valid";
                        keyid: string | null;
                        parameters: Parameters;
                    },
                >;
            },
        >,
    >,
>
ok(verification), or a bounded error such as core crypto.invalid_signature, freshness.expired, content.digest_mismatch, key.unknown_key, or replay.replayed.

See
Signing and verifying guide, reference, and the error reasons.
- Defined in verify.ts:547

Function verify

Parameters

See

Settings