code: func (f *fileFetcher) getVerifiedFile(aciPath string, a *asc) (*os.File, error) {
  	var aciFile *os.File // closed on error
  	var errClose error   // error signaling to close aciFile
  
  	f.maybeOverrideAsc(aciPath, a)
  	ascFile, err := a.Get()
  	if err != nil {
  		return nil, errwrap.Wrap(errors.New("error opening signature file"), err)
  	}
  	defer ascFile.Close()
  
  	aciFile, err = os.Open(aciPath)
  	if err != nil {
  		return nil, errwrap.Wrap(errors.New("error opening ACI file"), err)
  	}
  
  	defer func() {
  		if errClose != nil {
  			aciFile.Close()
  		}
  	}()
  
  	validator, errClose := newValidator(aciFile)
  	if errClose != nil {
  		return nil, errClose
  	}
  
  	entity, errClose := validator.ValidateWithSignature(f.Ks, ascFile)
  	if errClose != nil {
  		return nil, errwrap.Wrap(fmt.Errorf("image %q verification failed", validator.ImageName()), errClose)
  	}
  	printIdentities(entity)
  
  	return aciFile, nil
  }
docs: // fetch opens and verifies the ACI.