russellhaering / goxmldsig

Pure Go implementation of XML Digital Signatures
Apache License 2.0
154 stars 127 forks source link

Feedback: More strongly typed errors as means to provide better diagnostics #53

Open ricardofandrade opened 4 years ago

ricardofandrade commented 4 years ago

Not always the error message coming from this package makes sense in a broader context. That's where our application sometimes struggles to offer a better diagnostic for users.

One example is the error that occurs when the signing certificate differs from the one in the XML document: Could not verify certificate against trusted certs

The message seems sufficient in this context but we'd love to offer more insights for a quicker resolution, for example stating that signing certificate may need to be updated.

There's always room for improvement in error messages but we have no expectation that this package be responsible for provide such high level diagnostic in all cases. However, providing means for applications to handle errors selectively seems something within the reach of the package.

Currently to achieve this goal, we would have to watch for a particular error message with a logic based on string matching, which tends to be fragile. Instead, we'd rather match a particular error type.

In the last few years, the Go community has been moving in that direction: https://dave.cheney.net/2016/04/27/dont-just-check-errors-handle-them-gracefully https://golang.org/doc/go1.13#error_wrapping https://github.com/golang/go/wiki/ErrorValueFAQ

We're looking forward to see strongly typed errors over time.