Module validate 

The checks of [spec/17-validation.md] section 11.

Validation returns the first failure, in the order the specification presents the checks: file framing, then presence, then each chunk’s semantic rules, then layer data, then the integrity tree, then encryption.

That ordering is load-bearing. The conformance corpus asserts that each invalid vector fails its advertised check first, so a check that runs earlier than the specification’s order can mask the one a vector pins. Three orderings are chosen against the tempting alternative:

• presence.auth runs before crypt.chunk_flags. A file whose header sets ENCRYPTED with no AUTH chunk fails both, and the corpus pins the presence check for that vector.
• Every check over a chunk payload runs after crypt.chunk_flags. A descriptor that claims a payload is sealed while the file has no key would otherwise be read as plaintext and reported as a JSON error rather than a flag inconsistency.
• The integer rule for durations runs over the raw JSON, before the typed parse of the chunk carrying it. A fractional duration is a defective value, not a defective document, so it reports the named check (meta.time_integer and its siblings) rather than the generic JSON error a failed deserialization would produce.

A sealed file validated without a key is checked as far as its plaintext allows. The directory, HEAD, AUTH, LTBL, the LAYR version fields and LHAS are plaintext by construction (section 9.1), so those checks all run; the ones that need decrypted content are skipped rather than guessed at. Supply the key with Validator::with_key to run them.

Structs

Validator

A configured validator.

Enums

Level

How thoroughly to validate.

Functions

validate

Validate buf at level, returning the first failure.

validate_with_key

Validate an encrypted file, opening sealed units with key.