Enum VerifyError 

pub enum VerifyError {
    Io {
        path: PathBuf,
        source: Error,
    },
    KeyDecode(SnapshotKeyError),
    AuditPoolUnreachable {
        url: String,
        message: String,
    },
    Config(String),
    SymlinkSnapshot {
        path: PathBuf,
    },
}

Errors surfaced by [run]. Each variant carries enough context for an operator to act without grepping source — the I/O variants name the path, the key-decode variant carries the underlying SnapshotKeyError, and the audit-pool variant records the URL we failed to reach.

Variants

Io

Filesystem error walking the workspace’s migrations/ tree or reading a snapshot file.

Fields

path: PathBuf

Path the operation was attempted against.

source: Error

KeyDecode(SnapshotKeyError)

DJOGI_SNAPSHOT_SIGNING_KEY was set but malformed. Surfaced rather than silently degrading to the no-op sentinel — see load_signing_key_from_env documentation.

AuditPoolUnreachable

Could not connect to the audit database. The URL is included for diagnostics; the underlying error is preserved as the Display source.

Fields

url: String

The audit DB URL we attempted to connect to. Included so operator logs surface the resolution path (env var vs. derived from database.url).

message: String

Underlying connection error message — the DjogiError types do not implement Send + Sync in every variant we might receive, so we capture the rendered string here for stable display.

Config(String)

Reading Djogi.toml (and its env overlays) failed.

SymlinkSnapshot

A snapshot path resolved to a symlink rather than a regular file. Verify refuses to follow it — a malicious or accidental symlink could escape the workspace and cause djogi verify to hash an attacker-controlled file (e.g. /etc/passwd) before reporting a confusing MISMATCH against the audit ledger. The scanner already skips symlinked directories via entry.file_type().is_dir() returning false for symlinks; this variant closes the file-side gap on the same defense.

Residual TOCTOU window: between this symlink_metadata check and the subsequent std::fs::read, an attacker with write access to the migrations tree could swap the regular file for a symlink. Closing that window properly requires openat semantics (re-checking the metadata via the open file handle’s fd); for v0.1.0 the symlink-reject is the main exploit vector and the residual window is documented here. Phase 11 may revisit.

Fields

path: PathBuf

The snapshot path that resolved to a symlink.

Trait Implementations

impl Debug for VerifyError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for VerifyError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for VerifyError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.