Enum CorruptionDetection 

pub enum CorruptionDetection {
    Always,
    WhenPresent,
    Structural,
    Never,
}

Whether decoding a stream this codec itself wrote will notice corruption rather than silently returning wrong bytes, and — where it does — what kind of guarantee that is. A single bool used to carry this and meant two different things depending on the codec: a format-wide guarantee for gzip, but only “this build’s encoder turns on an optional checksum” for zstd. A caller reading one undifferentiated bool had no way to tell which promise it was getting, so the two review findings that added careful wording to the old field’s doc comment are migrated here, one paragraph per variant.

Variants

Always

The format mandates a check in every valid stream: gzip’s trailer CRC32, zlib’s Adler-32, bzip2’s per-block and whole-stream CRCs, snappy’s per-chunk CRC32C. This is a format-wide guarantee — it holds for any conforming stream, not just one this codec produced itself.

WhenPresent

The format permits a check but leaves it to the writer, so what a caller can trust depends on which writer actually produced the stream in front of them — not on which writer this codec happens to be. In principle that cuts both ways: a codec’s own encoder could turn the check on while some foreign writer leaves it off, or the reverse. Every codec in this tree currently sits on the first side — this build’s encoder turns the check on; a foreign writer might not. zstd’s content checksum, xz’s check-type field, and lz4’s frame content checksum are all per-writer choices the format permits omitting, and this project’s own encoders choose to enable all three: zstd’s crate-level encoder omits it by default (its CLI does not, but zstd_c.rs and zstd_pure.rs both turn it on regardless), every xz encoder measured here — liblzma’s and lzma-rust2’s — selects CRC64 without being asked, and lz4.rs’s encoder calls content_checksum(true), matching what the reference lz4 CLI writes by default. lz4 did not always sit here: earlier in this project’s history its own encoder left the checksum off, making it the mirror case — detection better on a typical foreign stream than on this codec’s own output — until that was measured to leave most corrupted positions in a self-written stream silently wrong (see lz4.rs’s caps() and decoder docs for the before/after figures). For all three formats, detection is weaker on a foreign stream than on this codec’s own output only when that foreign writer skipped the checksum — see zstd_c.rs’s decoder doc for a measured figure.

Either way, a codec built over one of these optional-check formats must document, at the point a caller would meet it, which direction it sits and what that is worth on a stream this build did not write; the doc comment on the codec’s own caps() is not enough by itself — the decoder needs one too.

Structural

No checksum exists, yet malformed input is still detected because the format’s own decoding constraints make corruption produce an invalid decoder state. LZMA1 is the example: it has no checksum, so it looked like Never — but it was never measured. Measured: sweeping four payload shapes — compressible text, incompressible random, a source corpus and all zeros — every corrupted stream either errored or decoded identically, with zero silent-wrong decodes in any of them. LZMA1’s range coder plus its end marker are constrained enough that a flipped bit almost always drives the decoder into an invalid state. This is detection by structural invalidity, not verification, and the difference from Always matters: a CRC gives a guarantee against arbitrary corruption, whereas structure gives a high empirical rate against random corruption and no promise at all against a deliberately crafted edit.

Never

The format carries no check at all — not optional, structurally absent: a bare deflate or brotli stream fed corrupt bytes produces different output rather than an error, for any writer, always. Such a format can never produce crate::Error::Corrupt, and a caller is entitled to know that rather than assume a guarantee that is not there. The conservative default: a codec must opt in to claiming any detection, matching CodecCaps’s “every field defaults to false” contract.

Trait Implementations

impl Clone for CorruptionDetection

fn clone(&self) -> CorruptionDetection

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for CorruptionDetection

impl Debug for CorruptionDetection

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CorruptionDetection

fn default() -> CorruptionDetection

Returns the “default value” for a type.

impl Eq for CorruptionDetection

impl PartialEq for CorruptionDetection

fn eq(&self, other: &CorruptionDetection) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for CorruptionDetection