Enum Untrusted 

#[non_exhaustive]
pub enum Untrusted {
    Missing,
    External {
        name: String,
    },
    Unresolved {
        name: String,
        digest: Digest,
    },
    Elsewhere {
        name: String,
    },
    Lost {
        section: u32,
    },
    Digest {
        expected: Digest,
        found: Digest,
    },
}

Why a decoder was not handed over.

Only one of these is a security event. The other three say the container does not carry a module this host can run, which is a bad file or an unfinished feature, and a host that wants to tell those apart in a log can match on the variant rather than read the text.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Missing

The container does not say which decoder reads it.

A container without a decoder reference is not unreadable, it is just not self decoding, and reading it is somebody else’s problem rather than this crate’s.

External

The decoder lives somewhere else and this host was not told it may go and get it.

This is the default and it fails closed. A decoder named by a URI means a dataset can cause a fetch and then have the result executed, which may well be fine and is not something a host should end up doing because nobody thought about it.

Fields

name: String

The decoder’s name, as the container gives it.

Unresolved

The decoder lives somewhere else, this host was told it may go and get it, and it came back with nothing.

A resolver that cannot find a decoder is an ordinary outcome rather than an attack: the registry is down, or the module was never published, or this host has no copy. The digest is here because it is what the next host to try should look for.

Fields

name: String

The decoder’s name, as the container gives it.

digest: Digest

The digest the module has to hash to, whoever finds it.

Elsewhere

The container puts the decoder somewhere this build has never heard of.

A newer writer describing a location this build does not know about is a file from the future, and the only safe reading of one is that this host cannot read it. Guessing which of the locations it does know about was meant is how a host ends up running the wrong bytes.

Fields

name: String

The decoder’s name, as the container gives it.

Lost

The decoder reference names a section the file does not have.

The footer parsed and then disagreed with itself. Nothing was substituted for the missing module and nothing ever will be, because a module that is not there has no digest to check.

Fields

section: u32

The section id the decoder reference names.

Digest

The module in the container does not hash to what the container says it should.

Both digests are in the message on purpose. The expected one identifies the decoder that was meant to be here, which is the thing to go and look for, and the found one identifies what actually arrived, which is the thing to keep for whoever asks how it got there.

Fields

expected: Digest

What the container claims the module is.

found: Digest

What the bytes in the container actually hash to.

Trait Implementations

impl Clone for Untrusted

fn clone(&self) -> Untrusted

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Untrusted

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for Untrusted

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for Untrusted

impl Error for Untrusted

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl PartialEq for Untrusted

fn eq(&self, other: &Untrusted) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for Untrusted