From 6f9f846bc0ebe91d95706e12a85bd0a6404eff7c Mon Sep 17 00:00:00 2001 From: Marc Hartmayer Date: Tue, 14 Jul 2026 18:29:57 +0200 Subject: [PATCH] pv: verify_chain: Use error statements instead of debug MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit These messages indicate verification failures and are therefore reported as errors rather than debug output. Unfortunately, X509StoreContext::init(...) expects the callback to return an OpenSSL ErrorStack, so it's not possible to propagate these failures through our own error hierarchy. Signed-off-by: Marc Hartmayer Reviewed-by: Steffen Eiden Signed-off-by: Jan Höppner --- rust/pv/src/verify/helper.rs | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/rust/pv/src/verify/helper.rs b/rust/pv/src/verify/helper.rs index 4da2dde7..e4dc6142 100644 --- a/rust/pv/src/verify/helper.rs +++ b/rust/pv/src/verify/helper.rs @@ -220,20 +220,22 @@ pub fn verify_chain( // verify certificate let res = ctx.verify_cert()?; if !res { - debug!("Failed to verify the signing key with the chain of trust"); + error!("error: Failed to verify the signing key with the chain of trust"); return Ok(res); } // verify that the chain is as expected let chain = match ctx.chain() { Some(c) => c, None => { - debug!("No verification chain in verify-context. (openssl BUG)"); + error!("error: No verification chain in verify-context. (openssl BUG)"); ctx.set_error(X509VerifyResult::APPLICATION_VERIFICATION); return Ok(false); } }; if chain.len() < SECURITY_CHAIN_MAX_LEN as usize { - debug!("Verification expects one root and at least one intermediate certificate",); + error!( + "error: Verification expects one root and at least one intermediate certificate", + ); ctx.set_error(X509VerifyResult::APPLICATION_VERIFICATION); return Ok(false); }