feat: add a verify command for signed trust manifests - #67

Stack: #61 ← #65 ← #67 ← #66. Review and merge in that order; each PR shows only its own commits.

Closes #63. Needs Agent-Card/ai-catalog-rust#61.

What ai-catalog verify does

It validates the catalog and runs ai_catalog_validate::verify (from Agent-Card/ai-catalog-rust#61) on the document as served, then prints a report:

• Per trust manifest: the did-web-v1 signature (signer, protected header, assertionMethod key in the signer's root did:web document, validity period, ES256 detached JWS) and the release binding of its subject to the entry.
• Per entry: whether the publisher endorsed it and, once a manifest is accepted, whether the artifact matches digest.
• The catalog's conformance level: Trusted only when an entry has a verified publisher endorsement and none fails.

The checks live in the library. The CLI supplies only what the library leaves to callers:

• Fetch: HTTPS only, no redirects, 10 s timeout, 16 MiB limit. It refuses IP-literal hosts and private, loopback, link-local, CGNAT, unique-local and IPv4-mapped-private addresses, and pins the checked addresses for the connection.
• --did-document DID=PATH: serves a local DID document for that DID's https://<domain>/.well-known/did.json. Only root did:web DIDs are accepted.
• --offline: fetches nothing; checks that would need a fetch come back unverifiable.
• Reports: text by default, --json for a structured report.

Exit codes: 1 if the catalog is invalid or any check fails; --strict also fails on unverifiable.

History

Later commits give each verify test its own temporary directory (parallel tests could share a time-based name) and update the README: validate now reports at most Discoverable, and verify reports Trusted.

The first commit implemented the checks inside the CLI. The second replaces them with the library's verify(), once Agent-Card/ai-catalog-rust#61 turned out to provide the same checks, so they live in one place.

Dependencies

ai_catalog_validate::verify shipped in ai-catalog-rust 0.4.0, and #61 here is bumped to it, so this builds against released crates and CI passes.

Testing

Tested against the released 0.4.0 crates.

• Command-level tests (generated keys, inline data, DID document supplied locally):
  • a valid publisher signature gives conformance: trusted and exits 0;
  • a tampered claim fails the signature check and exits 1;
  • offline without a DID document is unverifiable: exit 0, or exit 1 with --strict;
  • the JSON report carries the outcomes;
  • a non-root --did-document DID is rejected.
• Fetch tests: DID-to-URL mapping, overrides and offline mode, non-https and IP-literal URLs refused, private and local addresses disallowed.
• Checks: cargo test passes (67 + 37); cargo clippy --all-targets --all-features -- -D warnings and cargo fmt --check are clean.