pub struct CodecCaps {
pub encode: bool,
pub decode: bool,
pub parallel_encode: bool,
pub parallel_decode: bool,
pub frame_index: bool,
pub detects_corruption: CorruptionDetection,
pub memory_per_worker: Option<u64>,
pub weak_encoder: bool,
pub truncation_undetectable: bool,
}Expand description
What a codec can do. Every field defaults to false (or, for
detects_corruption, its equivalent conservative variant): a backend must
opt in.
Fields§
§encode: bool§decode: bool§parallel_encode: bool§parallel_decode: bool§frame_index: boolStream carries a frame/block index enabling random access.
detects_corruption: CorruptionDetectionSee CorruptionDetection for what each state promises.
memory_per_worker: Option<u64>Rough working-set cost of one encode worker, in bytes, when the codec
knows it. None means unknown — assume modest.
A static, conservative HIGH figure for callers who introspect
CodecCaps without encoding anything (property 12’s own governor
sizing, and each codec’s clamp test) — it is not what the governor
actually divides by during a real encode. The four codecs Phase 1f
gave a multi-threaded encoder (zstd-c, xz-c, xz-pure, lzip)
each call their own level-aware per_worker_bytes(level) for that,
because the true cost varies by preset (roughly 128 MiB below preset
7, ~896 MiB at 7 and above, for xz and lzip) and this field’s
contract is to round up to a single figure that covers every level a
caller might ask for.
weak_encoder: boolThis build’s encoder for the format is markedly worse than the format’s usual one — a fallback that produces valid output nobody would choose.
ops refuses to use it unless the caller opts in, because the output is
indistinguishable afterwards: a user who asked for .xz expects xz
ratios, and two builds of stuffr would otherwise produce very different
files from an identical command with no way to tell which they got.
truncation_undetectable: boolTrue only when the format itself carries no signal whatsoever — no
checksum, no length, no structural decode constraint, no end-of-stream
marker — that could ever distinguish a truncated stream from a complete
one. This does NOT exempt a codec from conformance property 10
(truncation, conformance.rs) — property 10 has no bare skip for any
declaration, deliberately: conformance.rs’s own mod broken_codecs
keeps testing::MockCodec, a bare unframed XOR pass-through,
specifically UNABLE to clear property 10
(mock_codec_clears_every_property_up_to_truncation), and a codec
that answered nothing at all about truncation would be
indistinguishable from one that never checked.
What this field switches property 10 to instead is a WEAKER, but
still falsifiable, property: on truncated input, the decoder must
either error, or produce a byte sequence that is a genuine prefix of
what the same decoder produces from the untruncated input — one that
never shrinks as a less severe truncation is tried (monotonicity
across the several cut lengths property 10 already sweeps), and that
is not trivially empty when the untruncated decode is not (closing
the residual gap a bare prefix check alone leaves: the empty string
is a prefix of everything). That still catches real defect classes —
a decoder that mishandles a partial final unit and emits wrong
trailing bytes, reordered bytes, or fabricated padding fails this
exactly as it would fail the strict “must always error” property, and
one that always answers empty on truncation fails it too — while not
demanding a guarantee the format cannot give. conformance.rs’s
a_decoder_that_returns_a_non_prefix_on_truncation_is_caught and
a_decoder_that_always_answers_empty_on_truncation_is_caught prove
the weaker check still fires, by mutation, the same way
mock_codec_clears_every_property_up_to_truncation proves the strict
one does.
Every real codec so far closes the gap the strict property demands: a
mandatory checksum (gzip, zlib, bzip2, snappy), a per-writer optional
one this build’s own encoder always turns on (zstd, xz, lz4),
structural invalidity from a range coder (LZMA1), or, for a codec with
neither, an explicit end-of-stream signal (raw deflate’s BFINAL bit
— see deflate.rs).
legacy::compress_z (Phase 3b) is the first exception, and this field
exists because of it, not in anticipation of it: Unix compress’s LZW
code stream has none of the above. A prefix of a valid stream decodes
via the identical state machine as the full stream and simply runs out
of bits, producing a shorter but otherwise byte-correct PREFIX of the
real output with no error — measured directly, at the bit level, on
this project’s own hello.Z fixture: cutting 1, 25 or 50 of its 51
bytes left between 5 and 7 leftover, unconsumed bits in every case,
including the GENUINE, untruncated end (6 leftover bits) — no leftover
count or value distinguishes a real ending from a truncated one, because
both stop for the identical reason (too few bits left for the next
code). Confirmed independently against two production reference
tools, not just this crate: /usr/bin/uncompress and /usr/bin/gzip -dc on macOS both exit 0 with silently-partial output on the same cut
files, and in every case what they emit is a strict prefix of the
untruncated decode — never garbage, never a differently-ordered or
padded result. This is a real, external, cross-validated fact about
the format, not a gap in compress_z’s own decoder — see that
module’s doc for the full measurement.
Defaults to false (the strict property applies) via
Self::round_trip and Self::decode_only, so every existing
codec’s behavior — including testing::MockCodec’s own deliberate
failure above — is unchanged; only compress_z::CompressZ sets this
explicitly.
Implementations§
Source§impl CodecCaps
impl CodecCaps
Sourcepub const fn round_trip() -> Self
pub const fn round_trip() -> Self
A codec that both compresses and decompresses, with no parallelism and no frame index. The common shape.
Sourcepub const fn decode_only() -> Self
pub const fn decode_only() -> Self
A decode-only codec — the pure-Rust fallbacks that let a build with no C
toolchain still open a .zst or .xz.