Enum TrustedRootKeyError 

pub enum TrustedRootKeyError {
    NoEcdsaP256Tlog,
    TlogLogIdNoMatch {
        invariant: &'static str,
        receipt_log_id: String,
        tlog_log_ids: Vec<String>,
    },
    MissingRawBytes,
    Base64 {
        reason: String,
    },
    DecodeKey {
        reason: String,
    },
}

Errors when extracting a typed Rekor verifying key from the active trusted root.

Variants

NoEcdsaP256Tlog

No transparency-log instance in the trusted root declared an ECDSA P-256 key. Cortex does not (yet) accept Ed25519 Rekor signatures.

TlogLogIdNoMatch

No transparency-log instance declared a logId.keyId that matches the Rekor receipt’s body.logID. Closes BH-3 (docs/reviews/BUG_HUNT_2026-05-12_post_8f43450.md Finding 3, Cosign GHSA-whqx-f9j3-ch6m class). Refusal is structural — there is no silent fall-back to the latest-activated tlog.

Fields

invariant: &'static str

Stable invariant token, equal to REKOR_TRUSTED_ROOT_TLOG_LOGID_NO_MATCH_INVARIANT.

receipt_log_id: String

body.logID from the Rekor receipt that failed to bind.

tlog_log_ids: Vec<String>

The tlog logId.keyId values declared in the trusted root, preserved verbatim from the JSON so operators can correlate with the Sigstore TUF history. Empty when every tlog omitted logId.keyId.

MissingRawBytes

The selected tlog declared no rawBytes field for its publicKey. The verifier refuses to fall back to inferring keys from other channels.

Base64

rawBytes was present but did not decode as base64.

Fields

reason: String

Underlying base64 decode failure.

DecodeKey

The decoded DER bytes did not parse as a P-256 SubjectPublicKeyInfo.

Fields

reason: String

Underlying p256/pkcs8 failure.

Trait Implementations

impl Debug for TrustedRootKeyError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for TrustedRootKeyError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for TrustedRootKeyError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.