Struct Unverified 

pub struct Unverified<T> { /* private fields */ }

A decrypted value whose file MAC has not been checked yet.

Carries everything the check needs so a caller cannot be asked for the MAC inputs at some later point where they are no longer in scope.

Implementations

impl<T> Unverified<T>

pub fn new( inner: T, computed: Mac, mac_field: impl Into<String>, lastmodified: impl Into<String>, leaves_fed: usize, ) -> Self

Wrap a freshly-decrypted value together with its MAC inputs.

pub fn computed_mac(&self) -> &Mac

The MAC recomputed from the decrypted contents.

pub fn leaves_fed(&self) -> usize

How many leaves went into the recomputed MAC. The denominator.

A MAC over zero leaves matches another MAC over zero leaves, so a walker that silently stopped finding leaves would verify green while checking nothing. Unverified::verify refuses that case outright; this getter lets a caller assert a specific expected count on top.

pub fn verify(self, key: &DataKey) -> Result<T, WireError>

Check the MAC and release the value.

Refuses a zero-leaf verification as vacuous. That is a deliberate divergence from upstream, which would happily verify an empty walk: the only file that legitimately has no leaves is an empty document, and treating one as authenticated is how a broken walker reads as a green gate. A caller that genuinely wants to accept an empty document can say so with Unverified::verify_allowing_empty.

pub fn verify_allowing_empty(self, key: &DataKey) -> Result<T, WireError>

Unverified::verify without the anti-vacuity refusal, for the genuinely empty document.

pub fn into_inner_ignoring_mac(self) -> T

The --ignore-mac escape.

Deliberately verbose. sops offers --ignore-mac and real operators need it — a file whose MAC broke because someone hand-edited lastmodified is still recoverable, and refusing outright would make us less useful than what we replace. So the escape exists; it is just impossible to take without typing its name.

pub fn map<U>(self, f: impl FnOnce(T) -> U) -> Unverified<U>

Map the wrapped value without unwrapping it, so a caller can keep transforming a still-unauthenticated tree without losing the marker.

Trait Implementations

impl<T> Debug for Unverified<T>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Never prints the wrapped value — it is decrypted plaintext, and this type is most likely to be Debug-printed exactly when someone is debugging a MAC failure over a real file.