code: func (s *Signatory) Verify(chartpath, sigpath string) (*Verification, error) {
  	ver := &Verification{}
  	for _, fname := range []string{chartpath, sigpath} {
  		if fi, err := os.Stat(fname); err != nil {
  			return ver, err
  		} else if fi.IsDir() {
  			return ver, fmt.Errorf("%s cannot be a directory", fname)
  		}
  	}
  
  	// First verify the signature
  	sig, err := s.decodeSignature(sigpath)
  	if err != nil {
  		return ver, fmt.Errorf("failed to decode signature: %s", err)
  	}
  
  	by, err := s.verifySignature(sig)
  	if err != nil {
  		return ver, err
  	}
  	ver.SignedBy = by
  
  	// Second, verify the hash of the tarball.
  	sum, err := DigestFile(chartpath)
  	if err != nil {
  		return ver, err
  	}
  	_, sums, err := parseMessageBlock(sig.Plaintext)
  	if err != nil {
  		return ver, err
  	}
  
  	sum = "sha256:" + sum
  	basename := filepath.Base(chartpath)
  	if sha, ok := sums.Files[basename]; !ok {
  		return ver, fmt.Errorf("provenance does not contain a SHA for a file named %q", basename)
  	} else if sha != sum {
  		return ver, fmt.Errorf("sha256 sum does not match for %s: %q != %q", basename, sha, sum)
  	}
  	ver.FileHash = sum
  	ver.FileName = basename
  
  	// TODO: when image signing is added, verify that here.
  
  	return ver, nil
  }
docs: // Verify checks a signature and verifies that it is legit for a chart.