pub enum ReasonCode {
Show 20 variants
VerdictClean,
VerdictRecommendedVersionNewer,
VerdictAbandoned,
VerdictLowTrust,
VerdictCveFound,
VerdictNotYetAssessed,
VerdictDegradedStale,
VerdictHasRemediation,
VerdictKevListed,
VerdictRansomwareListed,
VerdictExploitationCritical,
VerdictMalicious,
VerdictObfuscated,
VerdictDenyList,
VerdictRangeNotResolved,
ClientNetworkUnreachable,
ClientAuthFailed,
ClientBearerMissing,
ClientRateLimited,
RemediationNotFound,
}Expand description
Canonical 15-value ReasonCode registry — Rust mirror of sdk-js v0.4.1
dist/reason-codes.js. Drift = CI failure.
Variants§
VerdictClean
VerdictRecommendedVersionNewer
VerdictAbandoned
VerdictLowTrust
VerdictCveFound
CLEANLIB-511 (B2) / 503: unified reason for a VECTOR_VERDICT CVE finding
at LOW/MEDIUM/HIGH severity — retires the incoherent per-severity codes
(VERDICT_CLEAN on LOW = “no findings”, VERDICT_ABANDONED on MEDIUM =
“unmaintained”, VERDICT_LOW_TRUST on HIGH) which asserted facts unrelated
to “has a CVE”. Severity is carried in rich_data.severity.
VERDICT_ABANDONED stays reserved for the genuine abandonment_score
signal (derive_status), VERDICT_EXPLOITATION_CRITICAL for CRITICAL.
VerdictNotYetAssessed
CLEANLIB S1 (cycle-22, closes PM 731999 §1): canonical reason for a
not-yet-assessed package. INSUFFICIENT_DATA fails closed to WARN +
VERDICT_NOT_YET_ASSESSED — replaces the cycle-21 D1 VERDICT_CLEAN
placeholder (status-correct but reason-incoherent, Discipline #60).
VerdictDegradedStale
Server-side substrate freshness — substance-derived tier preserved,
reason overridden to surface staleness. Distinct from client-side
LIVE_DEGRADED cache-fallback (extension status bar; Cli7 offline mode).
VerdictHasRemediation
VerdictKevListed
VerdictRansomwareListed
CLEANLIB-176: package named in ransomware campaigns
(CVE_FINDING_ON_RANSOMWARE source projection). Semantically distinct
from KEV — a CVE can be ransomware-linked without being CISA-KEV-listed
and vice-versa; conflating them defeats the 176 differentiation goal.
Cross-SDK + Threat ratification PENDING (see CLEANLIB-176 comment 658233).
VerdictExploitationCritical
VerdictMalicious
CLEANLIB-176: confirmed/likely-malicious package (MALICIOUS_TRIAGE
source projection — typosquat / backdoor / protestware). Distinct from
VERDICT_EXPLOITATION_CRITICAL (a CVE being actively exploited):
malicious means remove + audit + rotate, not upgrade.
Cross-SDK + Threat ratification PENDING (see CLEANLIB-176 comment 658233).
VerdictObfuscated
VerdictDenyList
VerdictRangeNotResolved
CLEANLIB-518 (§3): the App could not resolve the requested semver range
to a concrete version (source_state = RANGE_NOT_RESOLVED, CLEANLIB-513).
Distinct from VERDICT_NOT_YET_ASSESSED — the package is not un-assessed,
the range is unresolved, so the customer must pin a concrete version.
Fixes the CLI banner↔body contradiction where a range-not-resolved verdict
rendered the “❔ Not yet assessed” banner while the reasoning body said the
opposite. Fails CLOSED to WARN (an unresolved range is not an ALLOW).
ClientNetworkUnreachable
ClientAuthFailed
ClientBearerMissing
ClientRateLimited
RemediationNotFound
Implementations§
Trait Implementations§
Source§impl Clone for ReasonCode
impl Clone for ReasonCode
Source§fn clone(&self) -> ReasonCode
fn clone(&self) -> ReasonCode
1.0.0 (const: unstable) · Source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source. Read more