Function provenance_matches 

fn provenance_matches(
    path: &Path,
    expected_archive_sha256: &str,
    binary_path: &Path,
) -> Result<bool, Report>

Returns true if the provenance marker at path records exactly the manifest-pinned expected_archive_sha256, and the binary at binary_path still hashes to the recorded binary digest.

Security

The cached executable is re-hashed on every reuse: a marker file alone cannot vouch for a binary that was modified or corrupted after extraction.