Struct SecretInjector 

pub struct SecretInjector { /* private fields */ }

Client for injecting secrets into the TEE via RA-TLS.

Connects to the guest’s RA-TLS attestation server, verifies the TEE during the TLS handshake, then sends secrets over the encrypted channel. The guest stores secrets in /run/secrets/ (tmpfs) and optionally sets them as environment variables.

Implementations

impl SecretInjector

pub fn new(socket_path: &Path) -> Self

Create a new secret injector for the given attestation socket.

pub async fn inject( &self, secrets: &[SecretEntry], policy: AttestationPolicy, allow_simulated: bool, ) -> Result<SecretInjectionResult>

Inject secrets into the TEE via RA-TLS.

1. Connects to the guest attestation server
2. TLS handshake verifies the TEE (attestation in cert)
3. Sends secrets over the verified encrypted channel (Frame protocol)
4. Guest stores secrets in /run/secrets/ and sets env vars

Arguments

• secrets - List of secrets to inject
• policy - Attestation policy for TEE verification
• allow_simulated - Whether to accept simulated TEE reports

Trait Implementations

impl Debug for SecretInjector

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.