{"record":{"id":"08d1d048dd91a493","repo":"rustfs/rustfs","slug":"signature-malformed","errorCode":"SIGNATURE_MALFORMED","errorMessage":"the signature is not 64 octets of fixed-width r||s in unpadded base64url","messagePattern":"the signature is not 64 octets of fixed-width r\\|\\|s in unpadded base64url","errorType":"exception","errorClass":"EnrollmentError","httpStatus":null,"severity":"error","filePath":"rustfs/src/connect/offline/enrollment.rs","lineNumber":163,"sourceCode":"    pub issued_at: String,\n    pub expires_at: String,\n    pub connect_key_id: String,\n    /// The signature value of the challenge, verbatim. It binds a response to\n    /// the one challenge it answers, so it is carried rather than recomputed.\n    pub challenge_proof: String,\n}\n\n/// Why an offline enrolment artifact was refused.\n///\n/// The variants are the frozen `reason` vocabulary of\n/// `fixtures/offline-enrollment/error-codes.json`, which spans both halves of\n/// the exchange. The device half implemented here produces the encoding, chain,\n/// version, and freshness reasons; the reasons that describe a response being\n/// evaluated against stored state — [`Self::ChallengeUnknown`],\n/// [`Self::ChallengeProofInvalid`], [`Self::DeviceProofInvalid`],\n/// [`Self::EnrollmentReplayed`], [`Self::OrganizationMismatch`], and\n/// [`Self::ClusterMismatch`] — are Connect's to raise and are named here so the\n/// two sides share one vocabulary.\n///\n/// No variant carries a payload: a rejection must never disclose key material,\n/// signature octets, nonces, or document bytes.\n#[derive(Debug, PartialEq, Eq, thiserror::Error)]\npub enum EnrollmentError {\n    #[error(\"protocolVersion is missing, malformed, or names an unsupported major version\")]\n    UnsupportedProtocol,\n\n    #[error(\"formatVersion is not a supported offline enrollment format\")]\n    UnsupportedFormat,\n\n    #[error(\"the signature is not 64 octets of fixed-width r||s in unpadded base64url\")]\n    SignatureMalformed,\n\n    #[error(\"the signature is not in its canonical low-S form\")]\n    SignatureNotCanonical,\n\n    #[error(\"the signature does not verify over the received octets\")]","sourceCodeStart":145,"sourceCodeEnd":181,"githubUrl":"https://github.com/rustfs/rustfs/blob/5dca076efed96e7b842de07c4c2111035ae7c7a2/rustfs/src/connect/offline/enrollment.rs#L145-L181","documentation":"EnrollmentError::SignatureMalformed fires when the document's signature is not exactly 64 octets of fixed-width r||s encoded as unpadded base64url — a strict structural check before any cryptographic verification.","triggerScenarios":"Thrown at rustfs/src/connect/offline/enrollment.rs:159 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Regenerate the artifact; the signer may have emitted DER or padded base64","Ensure no transport layer re-encoded or truncated the signature","Confirm the signing tool produces raw r||s in unpadded base64url"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"5dca076efed96e7b842de07c4c2111035ae7c7a2","analyzedAt":"2026-08-23T16:57:04.676Z","contentChangedAt":"2026-08-23T16:57:04.676Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}