Function verifyRecord

core/telemetry/integrity.js:118–148

(record, options = {})

}

function verifyRecord(record, options = {}) {
  if (!record || typeof record !== 'object') {
    return { status: 'invalid', reason: 'record is not an object' };
  }

  if (!record._hash || record._hash_v !== HASH_VERSION) {
    return { status: 'legacy', reason: 'missing hash fields' };
  }

  const expectedHash = hashRecord(record);
  if (expectedHash !== record._hash) {
    return { status: 'tampered', reason: 'hash mismatch', expectedHash, actualHash: record._hash };
  }

  if (record._signature) {
    if (record._signature_alg !== HMAC_ALGORITHM || record._signature_v !== SIGNATURE_VERSION) {
      return { status: 'signature-unsupported', reason: 'unsupported signature metadata' };
    }
    const key = resolveSigningKey(options);
    if (!key) {
      return { status: 'verified-unsigned-key-missing', reason: 'hash valid but signing key unavailable' };
    }
    const expected = signRecord({ ...record, _signature: undefined }, options)._signature;
    if (expected !== record._signature) {
      return { status: 'tampered', reason: 'signature mismatch', expectedSignature: expected, actualSignature: record._signature };
    }
    return { status: 'verified-signed', reason: 'hash and signature valid' };
  }

  return { status: 'verified', reason: 'hash valid' };
}

function verifyJsonlFile(filePath, options = {}) {
  const summary = {