From e968d2767fb19523269fa18fe5080de3e7cb3d19 Mon Sep 17 00:00:00 2001
From: swrup <swrup@protonmail.com>
Date: Tue, 17 Feb 2026 18:30:28 +0100
Subject: [PATCH]

---
 src/secmod.ml | 33 ++++++++++++++-------------------
 1 file changed, 14 insertions(+), 19 deletions(-)

diff --git a/src/secmod.ml b/src/secmod.ml
index 9e08f408..a9c980fc 100644
--- a/src/secmod.ml
+++ b/src/secmod.ml
@@ -205,16 +205,13 @@ module Make (Conn : Pg.CONN) = struct
   let database_find_sk conn pub =
     let* opt = Pg.find_signkey conn pub |> unwrap_err_caqti in
     match opt with
-    | None ->
-        Fmt.error "secmod failure: a signkey could not be found in database"
+    | None -> Fmt.error "secmod: signkey data not found in database"
     | Some sk_data -> Ok sk_data
 
   let database_find_dn conn h_pub =
     let* opt = Pg.find_denom conn h_pub |> unwrap_err_caqti in
     match opt with
-    | None ->
-        Fmt.error
-          "secmod failure: a denomination could not be found in database"
+    | None -> Fmt.error "secmod: denomination data not found in database"
     | Some dn_data -> Ok dn_data
 
   let list_to_ht l = Hashtbl.of_seq (List.to_seq l)
@@ -311,7 +308,7 @@ module Make (Conn : Pg.CONN) = struct
 
   let sign_with_signkey ~pub s =
     match Hashtbl.find_opt t.sk_key_ht pub with
-    | None -> Fmt.failwith "secmod failure: signkey not found."
+    | None -> Fmt.failwith "secmod sign_with_signkey failure: not found."
     | Some priv -> EddsaSignature.sign ~key:priv s
 
   let verify_with_sm_key s ~msg = EddsaSignature.verify ~key:t.sm_pubkey s ~msg
@@ -320,10 +317,9 @@ module Make (Conn : Pg.CONN) = struct
     EddsaSignature.verify ~key:Config.master_public_key
 
   let verify_with_signkey ~pub s ~msg =
-    (* check that [pub] is one of our own keys *)
     match Hashtbl.find_opt t.sk_ht pub with
-    | None -> Fmt.failwith "secmod failure: signkey not found."
-    | Some _priv -> EddsaSignature.verify ~key:pub s ~msg
+    | None -> Fmt.failwith "secmod verify_with_signkey failure: not found."
+    | Some _sk -> EddsaSignature.verify ~key:pub s ~msg
 
   let get_signkeys () = t.sk_ht |> Hashtbl.to_seq_values |> List.of_seq
   let get_denominations () = t.dn_ht |> Hashtbl.to_seq_values |> List.of_seq
@@ -344,11 +340,11 @@ module Make (Conn : Pg.CONN) = struct
       ( Hashtbl.find_opt t.future_sk_ht pub,
         Hashtbl.find_opt t.future_sk_key_ht pub )
     with
-    | None, _ | _, None -> Error "secmod failure: future signkey not found."
+    | None, _ | _, None ->
+        Error "secmod certify_future_signkey: future signkey not found."
     | Some future_sk, Some priv -> (
         match Hashtbl.find_opt t.sk_ht pub with
-        | Some _sk ->
-            Error "secmod failure: this signkey already has a master signature"
+        | Some _sk -> Error "secmod certify_future_signkey: already certified"
         | None ->
             let Api.FutureSignKey.
                   {
@@ -385,12 +381,12 @@ module Make (Conn : Pg.CONN) = struct
         Hashtbl.find_opt t.future_dn_key_ht h_pub )
     with
     | None, _ | _, None ->
-        Error "secmod failure: future denomination not found."
+        Error
+          "secmod certify_future_denomination: future denomination not found."
     | Some future_dn, Some priv -> (
         match Hashtbl.find_opt t.dn_ht h_pub with
         | Some _dn ->
-            Error
-              "secmod failure: this denomination already has a master signature"
+            Error "secmod certify_future_denomination: already certified"
         | None ->
             let Api.FutureDenom.
                   {
@@ -443,7 +439,7 @@ module Make (Conn : Pg.CONN) = struct
 
   let revoke_signkey pub revoked_sig =
     match Hashtbl.find_opt t.sk_ht pub with
-    | None -> Error "secmod failure: signkey not found."
+    | None -> Error "secmod revoke_signkey: signkey not found."
     | Some sk ->
         let sk = { sk with revoked_sig= Some revoked_sig } in
         Hashtbl.replace t.sk_ht pub sk;
@@ -453,7 +449,7 @@ module Make (Conn : Pg.CONN) = struct
 
   let revoke_denomination pub revoked_sig =
     match Hashtbl.find_opt t.dn_ht pub with
-    | None -> Error "secmod failure: denomination not found."
+    | None -> Error "secmod revoke_denomination: denomination not found."
     | Some dn ->
         let dn = { dn with revoked_sig= Some revoked_sig } in
         Hashtbl.replace t.dn_ht pub dn;
@@ -474,8 +470,7 @@ module Make (Conn : Pg.CONN) = struct
       |> List.of_seq
       |> list_iter (fun (h_pub, priv) ->
           match Hashtbl.find_opt t.dn_section_name_ht h_pub with
-          | None ->
-              Fmt.failwith "secmod save: invalid state, section_name not found"
+          | None -> Error "secmod save: invalid state, section_name not found"
           | Some section_name -> write_rsa (dn_fname section_name) priv)
     in
     Logs.info (fun m -> m "saved secmod private keys data");