Function verifyChainSignature

src/cli/maintain-audit.ts:117–122

(head: string, signature: string, key: string)

/** Timing-safe verification of a head signature. PURE. */
export function verifyChainSignature(head: string, signature: string, key: string): boolean {
  const expected = signChainHead(head, key);
  if (expected.length !== signature.length) return false;
  try { return timingSafeEqual(Buffer.from(expected, 'hex'), Buffer.from(signature, 'hex')); }
  catch { return false; }
}

/** Assemble the exportable log, signing the head when a key is provided. PURE (pass `exportedAt`). */
export function buildSignedAuditLog(runs: AuditableRun[], opts: { exportedAt: string; key?: string }): SignedAuditLog {