Enum VerificationMode 

pub enum VerificationMode {
    Cosign,
    Sha256Only,
    StrictCosignRequired,
}

How the upgrade checksum file was verified. Surfaced in the structured UpgradeOutput payload so consumers (CI, alerting) can detect when an upgrade silently fell back to SHA256-only and react.

• Cosign — full cosign signature verified against the release’s bundle + public key. Strongest guarantee: a publisher-compromise attacker without the cosign private key cannot forge a passing release.
• Sha256Only — cosign bundle, public key, or the cosign CLI was unavailable; verification fell through to checksums.txt SHA256 comparison only. Trusts the GitHub Releases publisher chain.
• StrictCosignRequired — strict cosign mode was requested by the caller (--require-cosign / CFGD_REQUIRE_COSIGN=1) and verification succeeded under that policy. Distinct from Cosign so audit consumers can tell apart “strict was demanded” from “strict happened by accident.”

JSON wire values are hyphenated (cosign, sha256-only, strict-cosign-required) — chosen for legibility in structured payloads. Variants spell the rename out per-variant rather than via a blanket rename_all because the workspace audit gate forbids the blanket form.

Variants

Cosign

Sha256Only

StrictCosignRequired

Implementations

impl VerificationMode

pub fn as_wire_str(self) -> &'static str

The wire/JSON form of the mode, matching the per-variant serde renames. Used by callers that emit ad-hoc JSON payloads (e.g. the upgrade CLI) without round-tripping through serde_json::to_value.

Trait Implementations

impl Clone for VerificationMode

fn clone(&self) -> VerificationMode

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for VerificationMode

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for VerificationMode

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for VerificationMode

fn eq(&self, other: &VerificationMode) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for VerificationMode

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Copy for VerificationMode

impl Eq for VerificationMode

impl StructuralPartialEq for VerificationMode