Enum VerifyError 

pub enum VerifyError {
    CosignNotFound {
        searched: Vec<PathBuf>,
    },
    CosignFailed {
        stderr: String,
    },
    Io(String),
    PolicyRequiresSig {
        owner: String,
    },
    AssetIncomplete {
        present: &'static str,
        missing: &'static str,
    },
    TrustedKeysParse {
        path: PathBuf,
        reason: String,
    },
    IdentityRegexpInvalid {
        got: String,
        reason: String,
    },
    CertParseFailed(String),
    UnsupportedKey(String),
    SignatureDecodeFailed(String),
    SignatureMismatch,
    IdentityNotFound,
    IdentityMismatch {
        found: String,
        expected_regex: String,
    },
    IssuerMismatch {
        found: String,
        expected: String,
    },
}

Errors surfaced by crate::verify::verify_plugin_signature and the trusted_keys.toml loader.

Variants

CosignNotFound

cosign binary not found on PATH or in any well-known location, and no cosign_binary override was configured.

Fields

searched: Vec<PathBuf>

Paths the discoverer probed.

CosignFailed

cosign verify-blob exited with a non-zero status.

Fields

stderr: String

stderr captured from the cosign invocation. Preserved verbatim so operators can diagnose identity mismatches or transparency-log failures.

Io(String)

IO error during signature/cert/bundle download or local process spawning.

PolicyRequiresSig

Trust policy is Require but the resolved release has no .sig + .cert assets.

Fields

owner: String

Repo owner that the policy resolved against.

AssetIncomplete

Release ships one half of the signing material but not the other (e.g. .sig without .cert). Implies a publish convention violation upstream; rejected outside Ignore.

Fields

present: &'static str

Asset suffix that was present (e.g. .sig).

missing: &'static str

Asset suffix expected as companion (e.g. .cert).

TrustedKeysParse

trusted_keys.toml failed to parse.

Fields

path: PathBuf

Path on disk where the file was loaded from.

reason: String

Parse failure reason.

IdentityRegexpInvalid

One of the [[authors]] entries declared an identity_regexp that does not compile under the Rust regex engine.

Fields

got: String

Offending regex string.

reason: String

regex::Regex::new error message.

CertParseFailed(String)

PEM/DER certificate could not be parsed.

UnsupportedKey(String)

Certificate is well-formed but does not carry an ECDSA-P256 public key — the only key type cosign uses today.

SignatureDecodeFailed(String)

Signature file could not be base64-decoded or DER-parsed.

SignatureMismatch

Signature did not verify against the certificate’s public key over SHA-256(blob). Either the blob, the certificate, or the signature has been tampered with.

IdentityNotFound

Certificate has no Subject Alternative Name URIs / emails — Fulcio always emits at least one, so an empty SAN almost certainly means we got handed the wrong cert.

IdentityMismatch

Certificate’s SAN entries do not match the policy’s identity_regexp.

Fields

found: String

First SAN entry the verifier inspected (URIs/emails joined for diagnostic clarity).

expected_regex: String

Regex from the matched author entry.

IssuerMismatch

Certificate’s Fulcio OIDC-issuer extension does not match the policy.

Fields

found: String

What the cert’s 1.3.6.1.4.1.57264.1.{1,8} extension reported.

expected: String

What the trust policy required.

Trait Implementations

impl Debug for VerifyError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for VerifyError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for VerifyError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.