Enum VerificationOutcome 

#[non_exhaustive]
pub enum VerificationOutcome {
    Verified {
        badge: Badge,
        matched_fingerprint: CertFingerprint,
    },
    NotAnsAgent {
        fqdn: String,
    },
    InvalidStatus {
        status: BadgeStatus,
        badge: Badge,
    },
    FingerprintMismatch {
        expected: String,
        actual: String,
        badge: Badge,
    },
    HostnameMismatch {
        expected: String,
        actual: String,
        badge: Badge,
    },
    AnsNameMismatch {
        expected: String,
        actual: String,
        badge: Badge,
    },
    DnsError(DnsError),
    TlogError(TlogError),
    CertError(CryptoError),
    ParseError(ParseError),
    DaneError(DaneError),
}

Result of a verification operation.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Verified

Verification passed.

Fields

badge: Badge

The verified badge.

matched_fingerprint: CertFingerprint

The fingerprint that matched.

NotAnsAgent

Not an ANS agent (no badge DNS record found).

Fields

fqdn: String

The FQDN that was looked up.

InvalidStatus

Badge status is invalid for connections.

Fields

status: BadgeStatus

The invalid status.

badge: Badge

The badge with invalid status.

FingerprintMismatch

Certificate fingerprint does not match badge.

Fields

expected: String

Expected fingerprint from badge.

actual: String

Actual fingerprint from certificate.

badge: Badge

The badge that didn’t match.

HostnameMismatch

Hostname does not match badge.

Fields

expected: String

Expected hostname from badge.

actual: String

Actual hostname from certificate.

badge: Badge

The badge that didn’t match.

AnsNameMismatch

ANS name does not match badge (mTLS client verification).

Fields

expected: String

Expected ANS name from badge.

actual: String

Actual ANS name from certificate.

badge: Badge

The badge that didn’t match.

DnsError(DnsError)

Verification failed due to a DNS error.

TlogError(TlogError)

Verification failed due to a transparency log error.

CertError(CryptoError)

Verification failed due to a certificate error.

ParseError(ParseError)

Verification failed due to a parse error.

DaneError(DaneError)

Verification failed due to a DANE/TLSA error.

Implementations

impl VerificationOutcome

pub fn is_success(&self) -> bool

Check if verification was successful.

pub fn is_terminal_status(&self) -> bool

Check if the agent is in a terminal status (revoked, expired, etc.).

Returns true for both badge-detected terminal status ([InvalidStatus]) and SCITT-detected terminal status ([ScittError::TerminalStatus] / [ScittError::AgentTerminal]). Callers should use this instead of pattern-matching individual variants.

pub fn is_not_ans_agent(&self) -> bool

Check if the agent is not registered with ANS.

pub fn badge(&self) -> Option<&Badge>

Get the badge if verification succeeded or partially completed.

pub fn into_result(self) -> AnsResult<Badge>

Convert to a Result, returning the Badge on success.

For badge-based verification, this is the natural accessor. For SCITT-verified outcomes that may not carry a badge, prefer into_scitt_result which returns Option<Badge> on success.

When the scitt feature is enabled:

• ScittVerified with a badge → Ok(badge)
• ScittVerified without a badge → Err(Configuration) (use into_scitt_result() instead)
• ScittError → Err(Scitt(..))

Trait Implementations

impl Debug for VerificationOutcome

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.