Function verifyPackageSignature

verifyPackageSignature(
    files: ReadonlyMap<string, Uint8Array<ArrayBufferLike>>,
    security: {
        security: {
            digitalSignatures?: { publicKey: string; signatureFile: string };
            integrityChecks: {
                checksumAlgorithm: "SHA-256";
                checksums: Record<string, string>;
            };
        };
    },
    provider: SignatureProvider,
    publicKeyPem?: string,
): Promise<boolean>
Verify the declared digital signature against the package contents. Returns false on mismatch (a mismatch is data, not an exception — callers that reject use assertPackageSignature). Without an explicit publicKeyPem the embedded key declared in security.json is used. Throws UnsignedPackageError when unsigned and SignatureError on structural problems.
Parameters
- files: ReadonlyMap<string, Uint8Array<ArrayBufferLike>>
- security: {
      security: {
          digitalSignatures?: { publicKey: string; signatureFile: string };
          integrityChecks: {
              checksumAlgorithm: "SHA-256";
              checksums: Record<string, string>;
          };
      };
  }
- provider: SignatureProvider
- OptionalpublicKeyPem: string
Returns Promise<boolean>
- Defined in capsium-js/packages/core/src/signatures.ts:104