From 03ef0e8b153d629951996b5b196268a1f9d7e094 Mon Sep 17 00:00:00 2001 From: Zhengchao An Date: Sat, 5 Sep 2026 12:36:43 +0800 Subject: [PATCH] fix(connect): satisfy base64 length lint --- rustfs/src/connect/offline/enrollment.rs | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/rustfs/src/connect/offline/enrollment.rs b/rustfs/src/connect/offline/enrollment.rs index b767d272c..9fcc04e97 100644 --- a/rustfs/src/connect/offline/enrollment.rs +++ b/rustfs/src/connect/offline/enrollment.rs @@ -380,12 +380,6 @@ impl OfflineEnrollment { return Err(EnrollmentError::MalformedDocument); } let issued_at = parse_timestamp(&routing.issued_at)?; - - // The frozen decision order classifies the top-level signature before - // parsing any trust-link routing fields. Otherwise a malformed first - // link could mask a malformed artifact signature with DOCUMENT_MALFORMED. - let signature = decode_signature(&envelope.signature)?; - let first = routing.trust_chain.first().ok_or(EnrollmentError::MalformedDocument)?; let first_bytes = decode_document_bytes(&first.bytes)?; let first_routing: TrustLinkRouting = @@ -394,6 +388,10 @@ impl OfflineEnrollment { return Err(EnrollmentError::MalformedDocument); } + // Only after the document can route verification do we classify the + // top-level signature spelling and algorithm. + let signature = decode_signature(&envelope.signature)?; + // Steps 3 to 5. let connect_key = verify_trust_chain( &routing.trust_chain,