namespace fedem::sign {
    enum class TrustLevel { TRUSTED, UNKNOWN, UNSIGNED, REJECTED };
}

Defined in <sign/TrustLevel.hh>. Header-only — no link needed for the enum and helpers themselves.

The result of Verifier::verify, DSOLoader::loadSigned and the minTrust argument to loadVerified. This library enforces nothing — the host maps a level to an action.

Values

Value	Meaning
TRUSTED	Valid Ed25519 signature and the signer's key is in the trusted-keys directory.
UNKNOWN	Valid signature, but the signer's key is not in the directory.
UNSIGNED	No .dso_manifest / .dso_sig sections in the file.
REJECTED	Sections present but the signature is cryptographically invalid, or the file's SHA-256 does not match the manifest.

REJECTED is the "someone changed this after signing, or forged the manifest" case — always hostile. UNSIGNED is merely "no claim was made".

Helpers

const char* trustLevelName( TrustLevel ) noexcept;   // "TRUSTED", "UNKNOWN", ...
bool        isSignatureValid( TrustLevel ) noexcept; // TRUSTED || UNKNOWN

isSignatureValid answers "was there a valid signature, regardless of whether we recognise the key" — i.e. true for TRUSTED and UNKNOWN, false for UNSIGNED and REJECTED.

Ordering for loadVerified

loadVerified(..., minTrust) treats the levels as a strength order:

TRUSTED  (strongest)  >  UNKNOWN  >  UNSIGNED
REJECTED — never satisfies any minTrust

So minTrust = UNKNOWN admits TRUSTED and UNKNOWN; minTrust = TRUSTED admits only TRUSTED.

Typical policy table

Level	dev	staging	production
TRUSTED	load	load	load
UNKNOWN	load + warn	load + warn	reject
UNSIGNED	load	reject	reject
REJECTED	reject	reject	reject