{"record":{"id":"9706123a178114fb","repo":"rustfs/rustfs","slug":"trust-chain-invalid","errorCode":"TRUST_CHAIN_INVALID","errorMessage":"a trust link is invalid, misordered, or outside its validity at the challenge issuedAt","messagePattern":"a trust link is invalid, misordered, or outside its validity at the challenge issuedAt","errorType":"exception","errorClass":"EnrollmentError","httpStatus":null,"severity":"error","filePath":"rustfs/src/connect/offline/enrollment.rs","lineNumber":175,"sourceCode":"/// the exchange. The device half implemented here produces the encoding, chain,\n/// version, and freshness reasons; the reasons that describe a response being\n/// evaluated against stored state — [`Self::ChallengeUnknown`],\n/// [`Self::ChallengeProofInvalid`], [`Self::DeviceProofInvalid`],\n/// [`Self::EnrollmentReplayed`], [`Self::OrganizationMismatch`], and\n/// [`Self::ClusterMismatch`] — are Connect's to raise and are named here so the\n/// two sides share one vocabulary.\n///\n/// No variant carries a payload: a rejection must never disclose key material,\n/// signature octets, nonces, or document bytes.\n#[derive(Debug, PartialEq, Eq, thiserror::Error)]\npub enum EnrollmentError {\n    #[error(\"protocolVersion is missing, malformed, or names an unsupported major version\")]\n    UnsupportedProtocol,\n\n    #[error(\"formatVersion is not a supported offline enrollment format\")]\n    UnsupportedFormat,\n\n    #[error(\"the signature is not 64 octets of fixed-width r||s in unpadded base64url\")]\n    SignatureMalformed,\n\n    #[error(\"the signature is not in its canonical low-S form\")]\n    SignatureNotCanonical,\n\n    #[error(\"the signature does not verify over the received octets\")]\n    SignatureInvalid,\n\n    #[error(\"the trust chain is not issued by a root pinned in this build\")]\n    EnrollmentRootUnknown,\n\n    #[error(\"a trust link is invalid, misordered, or outside its validity at the challenge issuedAt\")]\n    TrustChainInvalid,\n\n    #[error(\"connectKeyId is not the subject of the last trust link\")]\n    ConnectKeyUnchained,\n\n    #[error(\"no issued challenge matches this challengeId\")]","sourceCodeStart":157,"sourceCodeEnd":193,"githubUrl":"https://github.com/rustfs/rustfs/blob/5dca076efed96e7b842de07c4c2111035ae7c7a2/rustfs/src/connect/offline/enrollment.rs#L157-L193","documentation":"The offline-enrollment trust chain failed validation: a link is malformed, the links are misordered, or a link's validity window does not cover the challenge's issuedAt time. The at-fault input is the supplied trust-chain in the enrollment payload.","triggerScenarios":"Thrown at rustfs/src/connect/offline/enrollment.rs:171 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Regenerate the artifact ensuring the chain is ordered leaf-to-root","Verify intermediate certificates are within validity at issuance time","Obtain a freshly issued artifact if intermediates have expired"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"5dca076efed96e7b842de07c4c2111035ae7c7a2","analyzedAt":"2026-08-23T16:57:04.676Z","contentChangedAt":"2026-08-23T16:57:04.676Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}