Source: oas/oas/oas-attestation/src/verify.rs. SHA-256: 5bc06575da77ebb7e2a866752baca3b924e8d377a2019837c9e127e080569d69.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

verify::verify_credential

Verifies an OAS credential's proof against a known issuer public key.

Implements verification per OAS Specification §13.1:

Validates the credential structure (issuer/subject DIDs, required fields)
Checks that the proof exists and uses Ed25519Signature2020
Serializes the credential without proof
Canonicalizes via JCS (RFC 8785)
Decodes the multibase signature
Verifies the Ed25519 signature against the issuer's public key

This function does NOT check expiration or temporal validity. Use [verify_credential_with_time] for time-aware verification.

Arguments

credential - The signed credential to verify.
issuer_public_key - The 32-byte Ed25519 public key of the issuer.

Returns

Ok(()) if the credential is valid and the proof verifies.

Errors

[AttestationError::MissingProof] if no proof is present.
[AttestationError::InvalidProofSignature] if the proof type is wrong or signature is invalid.
[AttestationError::InvalidIssuer] or [AttestationError::InvalidSubject] for DID validation failures.

Examples

use oas_attestation::credential::OasCredential;
use oas_attestation::types::AttestationType;
use oas_attestation::sign::sign_credential;
use oas_attestation::verify::verify_credential;
use oas_crypto::keypair::OasKeyPair;

let keypair = OasKeyPair::generate();
let cred = OasCredential::builder()
    .issuer("did:oas:test:hmr:auditor")
    .subject_id("did:oas:test:agent:target")
    .issuance_date("2026-01-15T00:00:00Z")
    .subject_claim("auditType", serde_json::json!("codeAudit"))
    .subject_claim("result", serde_json::json!("pass"))
    .subject_claim("severityFindings", serde_json::json!({"critical": 0}))
    .subject_claim("toolOrMethodology", serde_json::json!("OWASP"))
    .subject_claim("auditDate", serde_json::json!("2026-01-15T00:00:00Z"))
    .attestation_type(AttestationType::SecurityAudit)
    .build()
    .unwrap();

let signed = sign_credential(
    &cred, &keypair,
    "did:oas:test:hmr:auditor#key-1",
    "2026-01-15T00:00:00Z",
).unwrap();

let result = verify_credential(&signed, &keypair.verifying_key_bytes());
assert!(result.is_ok());

pub fn verify_credential(
    credential: &OasCredential,
    issuer_public_key: &[u8],
) -> Result<(), AttestationError>;

Source line: 74.

verify::verify_credential_with_time

Verifies an OAS credential with temporal checks.

Performs all checks from [verify_credential] plus:

Checks that issuanceDate is not in the future
Checks that expirationDate (if present) has not passed

Arguments

credential - The signed credential to verify.
issuer_public_key - The 32-byte Ed25519 public key of the issuer.
now - The current time as an ISO 8601 string for comparison.

Returns

Ok(()) if the credential is valid, the proof verifies, and temporal constraints hold.

Errors

All errors from [verify_credential], plus:

[AttestationError::NotYetValid] if issuanceDate is in the future.
[AttestationError::Expired] if expirationDate has passed.

Examples

use oas_attestation::credential::OasCredential;
use oas_attestation::types::AttestationType;
use oas_attestation::sign::sign_credential;
use oas_attestation::verify::verify_credential_with_time;
use oas_crypto::keypair::OasKeyPair;

let keypair = OasKeyPair::generate();
let cred = OasCredential::builder()
    .issuer("did:oas:test:hmr:auditor")
    .subject_id("did:oas:test:agent:target")
    .issuance_date("2026-01-15T00:00:00Z")
    .expiration_date("2027-01-15T00:00:00Z")
    .attestation_type(AttestationType::SecurityAudit)
    .subject_claim("auditType", serde_json::json!("codeAudit"))
    .subject_claim("result", serde_json::json!("pass"))
    .subject_claim("severityFindings", serde_json::json!({"critical": 0}))
    .subject_claim("toolOrMethodology", serde_json::json!("OWASP"))
    .subject_claim("auditDate", serde_json::json!("2026-01-15T00:00:00Z"))
    .build()
    .unwrap();

let signed = sign_credential(
    &cred, &keypair,
    "did:oas:test:hmr:auditor#key-1",
    "2026-01-15T00:00:00Z",
).unwrap();

// Verify at a time when the credential is valid
let result = verify_credential_with_time(
    &signed,
    &keypair.verifying_key_bytes(),
    "2026-06-15T00:00:00Z",
);
assert!(result.is_ok());

pub fn verify_credential_with_time(
    credential: &OasCredential,
    issuer_public_key: &[u8],
    now: &str,
) -> Result<(), AttestationError>;

Source line: 180.

oas-attestation · verify

verify::verify_credential

Arguments

Returns

Errors

Examples

verify::verify_credential_with_time

Arguments

Returns

Errors

Examples

On this page