Members of fedem::dso::DSOLoader. Available only when dsold is built with plugin-sign — the CMake build then defines DSOLD_WITH_SIGN and these overloads appear.

struct SignedLoadResult {
    bool             loaded = false;
    std::string      soPath;    // resolved path
    sign::TrustLevel trust;
    std::string      detail;    // human-readable reason
};

static SignedLoadResult loadSigned(
    std::string const& soName,
    std::vector<std::string> const& searchDirs,
    std::string const& trustedKeysDir );

static void loadVerified(
    std::string const& soName,
    std::vector<std::string> const& searchDirs,
    std::string const& trustedKeysDir,
    sign::TrustLevel minTrust );

loadSigned

Resolves soName against searchDirs, loads it (plain dlopen, same as load), then runs Verifier::verify against trustedKeysDir and returns both outcomes. Loading is never blocked — even a REJECTED DSO is loaded; the caller decides whether to keep it, unload, or abort.

SignedLoadResult::loaded is false only if the file could not be found / dlopened (detail says why). Otherwise trust is one of TrustLevel's four values and detail is the verifier's explanation.

loadVerified

Same resolution and verification, but:

• if trust >= minTrust (ordering: TRUSTED is the strongest, then UNKNOWN, then UNSIGNED; REJECTED never satisfies anything) — the DSO stays loaded and the function returns normally;
• otherwise it throws fedem::exception::SignatureRejected (soPath(), reason()).

fedem::exception::FileNotFound is thrown if soName cannot be resolved / loaded at all.

Parameters

Name	Description
soName	File name of the DSO.
searchDirs	Directories to try, in order.
trustedKeysDir	Directory of *.pub PEM Ed25519 keys. Unparseable files are skipped.
minTrust	The floor for loadVerified. Typically TrustLevel::TRUSTED.

Examples

using namespace fedem;

auto r = dso::DSOLoader::loadSigned( "libCircle.so", dirs, "/etc/app/keys.d" );
if( !r.loaded ) throw std::runtime_error( r.detail );
if( r.trust == sign::TrustLevel::REJECTED )
    fatal( "tampered plugin: " + r.detail );          // still loaded — act now
else if( r.trust != sign::TrustLevel::TRUSTED )
    log().warn( "plugin {}: {}", r.soPath, r.detail );

// strict:
dso::DSOLoader::loadVerified( "libCircle.so", dirs,
                              "/etc/app/keys.d",
                              sign::TrustLevel::TRUSTED );  // throws unless TRUSTED

Notes

• The verifier caches by resolved path, so repeated loads of the same file do the crypto once.
• Neither call inspects the manifest's abiMajor / abiMinor — read them from Verifier::verify(...).data and enforce your own floor if you need ABI gating.
• loadSigned is the right primitive for a host that reads a "off" | "warn" | "strict" policy string — combine it with Verifier::shouldLoad.