Struct Unverified 

pub struct Unverified<T> { /* private fields */ }

A decrypted value whose file MAC has not been checked yet.

Carries everything the check needs so a caller cannot be asked for the MAC inputs at some later point where they are no longer in scope.

Implementations

impl<T> Unverified<T>

pub fn new( inner: T, computed: Mac, mac_field: impl Into<String>, lastmodified: impl Into<String>, leaves_fed: usize, ) -> Self

Wrap a freshly-decrypted value together with its MAC inputs.

pub fn computed_mac(&self) -> &Mac

The MAC recomputed from the decrypted contents.

pub fn leaves_fed(&self) -> usize

How many leaves went into the recomputed MAC. The denominator.

A MAC over zero leaves matches another MAC over zero leaves, so a walker that silently stopped finding leaves would verify green while checking nothing. Unverified::verify refuses that case outright; this getter lets a caller assert a specific expected count on top.

pub fn verify(self, key: &DataKey) -> Result<T, WireError>

Check the MAC and release the value.

Refuses a zero-leaf verification as vacuous. That is a deliberate divergence from upstream, which would happily verify an empty walk: the only file that legitimately has no leaves is an empty document, and treating one as authenticated is how a broken walker reads as a green gate. A caller that genuinely wants to accept an empty document can say so with Unverified::verify_allowing_empty.

pub fn verify_recording( self, key: &DataKey, stash: Option<&mut IvStash>, ) -> Result<T, WireError>

Unverified::verify, recording the MAC field’s own IV into stash.

Pass the same stash the decrypt walk filled. Upstream gets this for free because the mac field shares one Cipher with every leaf; without it a no-op re-encrypt leaves every data line untouched and moves the mac: line alone.

pub fn verify_allowing_empty(self, key: &DataKey) -> Result<T, WireError>

Unverified::verify without the anti-vacuity refusal, for the genuinely empty document.

pub fn into_inner_ignoring_mac(self) -> T

The --ignore-mac escape.

Deliberately verbose. sops offers --ignore-mac and real operators need it — a file whose MAC broke because someone hand-edited lastmodified is still recoverable, and refusing outright would make us less useful than what we replace. So the escape exists; it is just impossible to take without typing its name.

pub fn map<U>(self, f: impl FnOnce(T) -> U) -> Unverified<U>

Map the wrapped value without unwrapping it, so a caller can keep transforming a still-unauthenticated tree without losing the marker.

Trait Implementations

impl<T> Debug for Unverified<T>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Never prints the wrapped value — it is decrypted plaintext, and this type is most likely to be Debug-printed exactly when someone is debugging a MAC failure over a real file.