Method run

atomic-cli/src/commands/memory/verify.rs:31–96

(&self)

impl Command for MemoryVerify {
    fn run(&self) -> CliResult<()> {
        let root = find_repository_root()?;
        let repo = Repository::open(&root).map_err(CliError::Repository)?;

        let inputs = bridge::read_memory(&repo, &self.id)?;
        let node = match bridge::load_attestation(&repo, &self.id, &inputs)? {
            bridge::Attestation::None => {
                return Err(CliError::InvalidArgument {
                    message: format!(
                        "no attestation found for {}; run `atomic memory attest {}` first",
                        self.id, self.id
                    ),
                })
            }
            bridge::Attestation::Stale(_) => {
                return Err(CliError::InvalidArgument {
                    message: format!(
                        "the attestation for {} is stale (the memory changed since it was \
                         signed); re-run `atomic memory attest {}`",
                        self.id, self.id
                    ),
                })
            }
            bridge::Attestation::Fresh(node) => *node,
        };

        // Resolve the public key. `did:atomic` is a key fingerprint (not
        // recoverable to a key), so we verify against the default (or named)
        // identity and let verify_memory's DID check catch a mismatch.
        let store = IdentityStore::open_default().map_err(|e| {
            CliError::Internal(anyhow::anyhow!("Failed to open identity store: {}", e))
        })?;
        let identity = if let Some(name) = &self.identity {
            store
                .load_by_name(name)
                .map_err(|_| CliError::IdentityNotFound(name.clone()))?
        } else {
            store
                .get_default()
                .map_err(|e| {
                    CliError::Internal(anyhow::anyhow!("Failed to load default identity: {}", e))
                })?
                .ok_or_else(|| CliError::InvalidArgument {
                    message: "No default identity set. Create one first:\n  \
                              atomic identity new <name> --email <email> --set-default"
                        .to_string(),
                })?
        };

        verify_memory(&node, &identity.public_key).map_err(|e| CliError::InvalidArgument {
            message: format!(
                "verification failed: {e} (if this memory was attested by a different \
                 identity, pass --identity <name>)"
            ),
        })?;

        println!("Verified memory: {}", self.id);
        println!(