verify

var Cmd = &cobra.Command{
	Use:   "verify <receipt-file>",
	Short: "Verify a committed reproducibility receipt against a run's state",
	Long: "Re-derive the reproducibility receipt named by <receipt-file> from the " +
		"run's persisted state and report drift: a moved image tag (digest " +
		"mismatch), a changed manifest, a changed input. It does NOT resurrect " +
		"deleted source data — it re-derives the signature and proves what ran.\n\n" +
		"The job and run IDs are read from the receipt file. Exits non-zero when " +
		"the run drifted from the receipt OR cannot be soundly verified (it ran " +
		"on an unpinned, mutable image tag).",
	Args: cobra.ExactArgs(1),
	RunE: func(cmd *cobra.Command, args []string) error {
		committed, err := loadReceipt(args[0])
		if err != nil {
			return err
		}
		if committed.RunID == uuid.Nil || committed.JobID == uuid.Nil {
			return fmt.Errorf("receipt %s has no run_id/job_id; is it a valid caesium receipt?", args[0])
		}

		server := strings.TrimSuffix(verifyServer, "/")
		url := fmt.Sprintf("%s/v1/jobs/%s/runs/%s/receipt/verify", server, committed.JobID, committed.RunID)

		payload, err := json.Marshal(committed)
		if err != nil {
			return err
		}

		req, err := http.NewRequestWithContext(cmd.Context(), http.MethodPost, url, bytes.NewReader(payload))
		if err != nil {
			return err
		}
		req.Header.Set("Content-Type", "application/json")

		resp, err := http.DefaultClient.Do(req)
		if err != nil {
			return err
		}
		defer func() { _ = resp.Body.Close() }()

		body, _ := io.ReadAll(resp.Body)
		if resp.StatusCode >= http.StatusBadRequest {
			return fmt.Errorf("verify failed (%d): %s", resp.StatusCode, strings.TrimSpace(string(body)))
		}

		var result ireceipt.VerifyResult
		if err := json.Unmarshal(body, &result); err != nil {
			return fmt.Errorf("decode verify response: %w", err)
		}

		if verifyJSON {
			pretty, mErr := json.MarshalIndent(&result, "", "  ")
			if mErr != nil {
				return mErr
			}
			_, _ = fmt.Fprintln(cmd.OutOrStdout(), string(pretty))
		} else {
			printHuman(cmd, &result)
		}

		if !result.Match {
			cmd.SilenceUsage = true
			cmd.SilenceErrors = true
			if result.Degraded {
				return fmt.Errorf("UNVERIFIABLE: run ran on unpinned image tag(s); not reproducible")
			}
			return fmt.Errorf("DRIFT: run no longer matches the committed receipt")
		}
		return nil
	},
}