Running it

No install is needed. From the repository root:

PYTHONPATH=packages/ver-validator/src .venv/bin/python -m ver_validator.cli <file>

python -m ver_validator.cli and the ver-validate entry point are the same program with the same arguments; every example below uses the short spelling ver-validate for readability. In an environment whose virtualenv has pip, installing gives you that entry point on PATH (this repository's .venv does not have pip, which is why the no-install invocation is the one to reach for):

pip install -e packages/ver-validator                 # validation only
pip install -e "packages/ver-validator[signatures]"   # + signature verification

The signatures extra pulls in rfc8785 (JCS canonicalization) and cryptography. Without it, stage 15 reports signatures as unverified rather than pretending to check them.