Enum TrustError 

#[non_exhaustive]
pub enum TrustError {
    CertificateGeneration {
        reason: String,
    },
    CertificateParsing {
        reason: String,
    },
    CertificateVerification {
        reason: String,
    },
    CertificateRevocation {
        reason: String,
    },
    MerkleTree {
        reason: String,
    },
    Seal {
        reason: String,
    },
    UnsealFailed,
    AttestationFailed,
    KeyManagement {
        reason: String,
    },
    Signing {
        reason: String,
    },
    InvalidSignature,
    CheckpointEncoding {
        reason: String,
    },
    CheckpointParsing {
        reason: String,
    },
    VerifierKey {
        reason: String,
    },
    NoteVerification,
    LogArtifactEncoding {
        reason: String,
    },
    LogArtifactVerification,
    ReceiptVerification,
    BundleVerification,
}

Errors returned from the trust primitives.

Variants are grouped by operation: certificate lifecycle (generation, parsing, verification, revocation), the Merkle transparency log, sealed payload transport (seal/unseal), key management, signing, and the dedicated signature-verification failure.

Why this is #[non_exhaustive]

Downstream matches must carry a wildcard arm, which makes every future variant an additive change instead of a breaking one. That matters more here than in a typical library: this crate gains a verification surface with each new artifact class, and each one wants its own non-oracle failure value (see Self::ReceiptVerification and Self::BundleVerification). Without this attribute, giving a new artifact class an honest error would mean a semver break, and the cheap way out — reusing another class’s variant — makes errors mean less over time.

Non-oracle variants carry no cause, deliberately

The verification failures are deliberately causeless. A caller learns that an artifact failed, never which check failed, because these types are reachable from network-exposed surfaces where a distinguishable error is a parsing oracle. Callers diagnosing their own artifacts verify the embedded pieces individually, where the errors are specific and actionable.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

CertificateGeneration

Generating a certificate failed.

Fields

reason: String

Human-readable cause of the generation failure.

CertificateParsing

Parsing a certificate or extracting one of its fields failed.

Fields

reason: String

Human-readable cause of the parsing failure.

CertificateVerification

Verifying a certificate chain failed.

Fields

reason: String

Human-readable cause of the verification failure.

CertificateRevocation

A certificate revocation operation failed.

Reserved for consumer-side operations: revocation tracking is explicitly a consumer concern (a design non-goal for this crate), so this crate never constructs the variant itself. It exists so consumers implementing revocation stores can surface failures through the shared TrustError type.

Fields

reason: String

Human-readable cause of the revocation failure.

MerkleTree

A Merkle transparency-log operation failed.

Fields

reason: String

Human-readable cause of the Merkle operation failure.

Seal

Sealing a payload for a recipient failed.

Fields

reason: String

Human-readable cause of the seal failure.

UnsealFailed

Unsealing failed — deliberately omits the cause so callers cannot distinguish wrong-key from tampered-ciphertext (non-oracle).

AttestationFailed

Attestation verification failed — the sender’s public key did not match, or the signature over the sealed payload was invalid.

KeyManagement

A key-management operation failed: file I/O, environment loading, base64 decoding, or key-material length validation.

Fields

reason: String

Human-readable cause of the key-management failure.

Signing

Producing a signature failed.

Reserved for consumer-side signing pipelines. This crate’s own Ed25519 signing is infallible (dalek 2 deterministic signing), so the crate never constructs the variant itself; consumers whose signing paths can fail (HSMs, remote signers, key lookups) surface those failures through it.

Fields

reason: String

Human-readable cause of the signing failure.

InvalidSignature

A signature failed verification, or the supplied signature or public key bytes were structurally invalid.

This is also the attestation artifact class’s single non-oracle failure: a malformed or non-canonical COSE attestation artifact, a payload-hash mismatch, and an invalid signature all collapse to this one value, so callers cannot distinguish which check rejected the artifact.

CheckpointEncoding

Building or encoding a checkpoint or signed note failed (invalid origin or key name, malformed body).

Fields

reason: String

Human-readable cause of the encoding failure.

CheckpointParsing

Parsing a checkpoint body failed. Used on already-verified body text and operator-supplied text; artifact verification collapses it (non-oracle).

Fields

reason: String

Human-readable cause of the parsing failure.

VerifierKey

A note verifier key string was malformed or internally inconsistent. Trusted operator input — carries an actionable reason.

Fields

reason: String

Human-readable cause of the verifier-key failure.

NoteVerification

A signed note failed verification — deliberately omits the cause so callers cannot distinguish malformed envelope, unknown key, or bad signature (non-oracle).

LogArtifactEncoding

Building a log proof artifact failed (tree too large for JSON-safe integers, size/index invariant violations at build time).

Fields

reason: String

Human-readable cause of the encoding failure.

LogArtifactVerification

A log proof artifact failed verification — deliberately omits the cause (non-oracle): bad checkpoint signature, size mismatch, root mismatch, malformed hashes, and kind confusion are indistinguishable.

ReceiptVerification

An anchor receipt failed verification — deliberately omits the cause (non-oracle): a bad signature, the wrong anchor key, a tampered inclusion path, a malformed or non-canonical artifact, and a leaf the receipt does not prove are all indistinguishable.

Distinct from Self::InvalidSignature, which it previously reused: a receipt failure is not necessarily a signature failure, and saying so misdescribed every other way one can fail. The class of artifact is already known to the caller from the function they called, so naming it leaks nothing a caller did not supply.

BundleVerification

A verification bundle failed verification — deliberately omits the cause (non-oracle): a malformed container, a broken inclusion proof, a receipt from the wrong anchor, and a chain whose links do not join are all indistinguishable.

Distinct from Self::LogArtifactVerification, which it previously reused, for the same reason: a bundle is a different artifact class with a different set of ways to be wrong.

Trait Implementations

impl Debug for TrustError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for TrustError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for TrustError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.