verificationinclude

Verificationinclude is a concept used in some verification toolchains to specify that a resource brought into a verification or analysis workflow must itself be verified before use. It is not a formal standard and its exact semantics vary by implementation, but the core idea is to extend integrity and provenance checks to includes.

In typical implementations, a verificationinclude directive triggers a verification step when the host file is loaded. The included resource is matched against a provenance manifest or a set of cryptographic checksums, signatures, or policy rules. If the checks pass, the resource is loaded and processed; if not, the system blocks the inclusion and reports an error.

Syntax and usage are often defined in a project’s configuration language or scripting API. A verificationinclude entry may specify the path, an expected hash, a signer, a verification policy, and a minimum version. Some tools allow cascading verification where included files themselves can contain verificationinclude directives for nested resources.

Applications include formal verification, model checking, and security pipelines where reproducibility and trust are important. By tying inclusion to verification, teams reduce supply-chain risk and improve the reliability of results.

Limitations include added runtime overhead, the need for trusted manifests, potential fragility with dynamic content, and maintenance of verification metadata. It also relies on robust key management and secure storage of provenance data.

See also: include directive, code signing, provenance, manifest, reproducible builds.