Greptile Summary

This PR fixes a gap where trust-list results were not factored into the final status/isValid fields of verifySignature. Documents signed with certificates whose issuer is absent from (or not active in) the configured trust list would previously report VALID; they now correctly report INDETERMINATE with an ISSUER_NOT_TRUSTED limitation. A similar downgrade is added for trust-list provider errors (TRUST_LIST_CHECK_FAILED). A committed demo-certificate fixture enables the new integration tests to run without sensitive samples.

Key changes:

• isValid promoted from const to let in verifySignature so the post-status-determination block can mutate it.
• New downgrade block (lines 1533–1555) triggers only when status === "VALID" and a trustListProvider is configured; handles three cases: issuer not found, found but not trusted at signing time, and provider error.
• tests/integration/batch_edoc.test.ts gains a reusable verifyUntrustedIssuer helper that covers both the public invalid_samples fixture and an optional sensitive directory.
• The trustedAtTime === false strict-equality guard in the downgrade condition can silently pass a TrustListMatch where found: true but trustedAtTime is undefined (e.g. from a custom provider); the checklist would show indeterminate for that item while the overall status remains VALID.

Confidence Score: 4/5

• Safe to merge with a minor fix recommended for the trustedAtTime === undefined edge case in the downgrade condition.
• The core logic is correct for all cases exercised by the tests and the built-in trust-list matcher (which always sets trustedAtTime when query.time is supplied). The one identified gap — a TrustListMatch where found: true but trustedAtTime is omitted — is not reachable via the built-in provider in normal operation but is reachable through a custom TrustListProvider, creating a mismatch between status: "VALID" and an indeterminate checklist item. The fix is a one-line change to the guard condition.
• The downgrade block in src/core/verification.ts around line 1536 deserves attention regarding the trustedAtTime === false strict equality check.

Important Files Changed

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[verifySignature called] --> B[Crypto validation\ncertResult + checksumResult\n+ signatureResult + timestamp]
    B --> C{isValid?}
    C -- No --> D[status = INVALID /\nINDETERMINATE /\nUNSUPPORTED\nbased on failure reason]
    C -- Yes --> E[status = VALID]
    E --> F{trustListProvider\nconfigured?}
    F -- No --> G[Return VALID]
    F -- Yes --> H{trustListMatch\navailable?}
    H -- Yes --> I{found AND\ntrustedAtTime\n≠ false?}
    I -- found=false OR\ntrustedAtTime=false --> J[status = INDETERMINATE\nlimitations += ISSUER_NOT_TRUSTED]
    I -- found=true AND\ntrustedAtTime=true --> G
    I -- found=true AND\ntrustedAtTime=undefined --> K[⚠️ status stays VALID\nbut checklist =\nindeterminate]
    H -- No → trustListError set --> L[status = INDETERMINATE\nlimitations += TRUST_LIST_CHECK_FAILED]
    H -- No, no error --> G
    J --> M[Return INDETERMINATE]
    L --> M
    D --> N[Return non-VALID]

_{Last reviewed commit: aa40d1a}

@greptileai @codex please recheck fixes

Codex Review: Didn't find any major issues. 👍