pub enum UnverifiedCause {
UndecodableMethod,
NoDeclaredLength,
OverEntryCeiling {
needed: u64,
ceiling: u64,
},
}Expand description
Why an entry is SalvageStatus::Unverified.
Three causes, and the STATUS does not distinguish them because the
decision they lead to is identical (listed, not written, exit 3) — the
same split crate::salvage’s consumers apply to
SalvageStatus::Partial via their own cause type (entries.rs’s
PartialCause, one crate up): a tier carries a decision, a message
carries a cause.
Variants§
UndecodableMethod
This build recognises the entry’s compression method but cannot decode it (zip method 99 is AES, 14 is LZMA — recognised, not decoded).
NoDeclaredLength
No length was available to bound the payload, so it was never read —
a data-descriptor entry the raw scan found with no central-directory
record to reconcile against. A CD-reconciled data-descriptor entry
gets a real declared length and CRC from the central directory and
does NOT reach this cause; see zip_salvage.rs’s
candidate_from_cd_record.
OverEntryCeiling
The bytes this entry would have required are past the ceiling this
run will read for ONE entry — policy.max_entry narrowed by the
scanner’s own SalvageScan::max_whole_entry — so nothing was read
and nothing was decoded. See annotate_candidates, which is the
one place that decides this, for the whole rule.
§Why this is a cause and not an Err
Salvage Stage 2 Task 3c’s fix round 3. This refusal used to be an
crate::Error::ResourceLimit raised from two different places — the
engine’s own collect_candidates, and (for ARC) the scanner’s own
verify — and an Err at either site aborts the whole run:
measured at the CLI on a two-entry archive whose second entry was
over the ceiling, stuffr salvage --list printed no rows at all and
exited 6, and salvage -C out left the destination empty, losing a
first entry that decodes perfectly. That is the one thing this verb
exists not to do. Three fix rounds chased the shape from site to
site; what actually closes it is that an over-ceiling entry has a
STATUS, so there is no Err left to propagate.
Distinct from SalvageStatus::Partial, which is what this used to
collapse into once the Err was folded away at the write layer: a
truncated entry’s genuine prefix IS recovered (as NAME.partial),
while an over-ceiling entry has real bytes nobody read. Reporting it
as Partial (truncated) stated two false things — the entry is not
truncated, and the empty NAME.partial it produced said nothing
survived.
§Why it carries both figures (fix round 4, NEW-F)
The Err this replaced carried a sentence naming the declared size
and the ceiling; the first version of this variant was a unit, so a
user meeting a container’s own fixed ceiling was told neither number
and could not tell whether --max-entry would help. The cause is
the only place that knows both, so it carries both and the CLI row
prints them — the project’s own “a message carries a cause”, with
the numbers that make the message actionable.
Fields
needed: u64Bytes reading this entry would have required: the BOUNDED
figure the comparison actually used — available_len when the
payload is truncated, the header’s declared_len otherwise —
never the raw declaration when the file holds less than it.
ceiling: u64The ceiling in force for this run: SalvagePolicy::max_entry
narrowed by SalvageScan::max_whole_entry. Equal to
max_entry means --max-entry can raise it; below it means a
whole-decoding container’s own fixed ceiling decided, and no
flag moves that.