Module backend 

Pluggable signing / key-store backends.

The agent is a proxy: incoming NEW_KEY / SIGN / VERIFY messages are dispatched to a Backend trait object. v1 ships a single implementation, vault::VaultBackend (a Vault-compatible transit engine: HashiCorp Vault or OpenBao), but the trait is deliberately backend-agnostic so additional stores (db-keystore, 1Password, cloud KMS, an internal TPM-backed signer, …) can be added later without touching the protocol or the connection handler.

Modules

spiffe

Vault-compatible (Vault or OpenBao) transit backend authenticated with a self-minted JWT-SVID instead of a static token.

vault

Vault-compatible (HashiCorp Vault or OpenBao) transit backend, authenticated with a static token (X-Vault-Token).

Structs

KeyMetadata

Value-free metadata for one key, returned by list.

KvSecret

A KV-v2 SECRET read: the stored bytes wrapped in Zeroizing plus the version they came from.

KvValue

A KV-v2 value read: the stored bytes plus the version they came from.

NewKey

A newly created (or imported) key.

PublicKey

A key’s public material plus the metadata get_public_key echoes back.

X509Bundle

Trust-domain X.509 bundle material, ready for Workload API response assembly.

X509CertRequest

Parameters for a DNS/IP-SAN X.509 leaf issuance (a TLS cert, not a SPIFFE SVID). Mirrors Backend::issue_x509_svid but binds DNS/IP SANs and a common name instead of a SPIFFE URI SAN.

X509Svid

An issued X.509-SVID leaf set from a PKI backend.

Enums

BackendError

Errors a backend may return. Service adapters map these to canonical gRPC statuses.

NativeAlgorithm

A post-quantum algorithm a Backend may natively custody and operate on in place: the private seed never leaves the backend.

SignOptions

Backend signing mode for operations whose wire format fixes an algorithm.

Traits

Backend

A pluggable key-store + signing backend.