pub enum Attestation {
ContentChecksum,
HeaderChecksumOnly,
Nothing,
}Expand description
Which class of evidence a FORMAT offers for one of its entries — a
per-format constant, and the third argument to the honesty oracle
stuffr_core::testing::check_salvage_claim.
Always compiled, unlike the oracle, since Salvage Stage 3 Task 5:
stuffr formats’ SALVAGE column renders it (yes only for
Attestation::ContentChecksum), so it cannot live behind the
testing feature with the oracle that consumes it. Which format has
which class is stated once, beside the scanner dispatch
(stuffr::entries::salvage_attestation); the fuzz target and the corpus
generator read it from there rather than keeping a table of their own.
Three classes, which is why this is an enum and not a bool. Salvage
Stage 3 Task 1 first shipped the argument as format_offers_verifier: bool, and its fix round’s review showed with a truth table that no
reading of a two-valued flag can hold the boundary: read as “a content
checksum”, it let cpio claim SalvageStatus::Complete; read as “a
content checksum OR a self-verifying header” (the shipped reading), it
let tar claim SalvageStatus::Intact and — live against the five
scanners that shipped before this stage — let zip, arc, zoo, lha
or arj answer Complete for an entry whose CRC was compared and
DISAGREED, turning an exit-4 Partial into an exit-0 clean recovery.
Both false claims sat in the one cell (checked, offers) that tar’s
honest Complete also occupies, so no function of those inputs could
refuse them and permit it. Ruling 3-G.
Two bools (offers_content_checksum, header_self_verifies) were
considered and refused: four states for three classes, one of them
meaningless, and the split pushed back onto every caller. Here each
scanner NAMES its class.
Deliberately NOT #[non_exhaustive], for the reason Ruling 3-D kept
it off SalvageStatus: a fourth class of evidence must fail to compile
at every match, check_salvage_claim’s own included, rather than be
absorbed by a wildcard arm that decides what it permits by accident.
Variants§
ContentChecksum
A checksum over the entry’s CONTENT, computed by the original writer —
zip, arc, zoo, lha, arj. The only class that can earn
SalvageStatus::Intact.
HeaderChecksumOnly
A checksum over the HEADER only; the content has none — tar. The
only class that can earn SalvageStatus::Complete: “every declared
byte was present and the header self-verified” is exactly what this
class can prove and all it can prove.
Nothing
Neither — cpio, ar. A coincidental header match and a real entry
are indistinguishable in the bytes, so the only honest tier this
class can reach on a whole entry is SalvageStatus::Unattested.