Trait Backend 

pub trait Backend: Send + Sync {
    // Required methods
    fn kind(&self) -> &'static str;
    fn new_key<'life0, 'async_trait>(
        &'life0 self,
        key_type: KeyType,
    ) -> Pin<Box<dyn Future<Output = Result<NewKey, BackendError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait;
    fn public_key<'life0, 'life1, 'async_trait>(
        &'life0 self,
        key_id: &'life1 str,
    ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, BackendError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait;
    fn sign<'life0, 'life1, 'life2, 'async_trait>(
        &'life0 self,
        key_id: &'life1 str,
        message: &'life2 [u8],
    ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, BackendError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait;
    fn verify<'life0, 'life1, 'life2, 'life3, 'async_trait>(
        &'life0 self,
        key_id: &'life1 str,
        message: &'life2 [u8],
        signature: &'life3 [u8],
    ) -> Pin<Box<dyn Future<Output = Result<bool, BackendError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait,
             'life3: 'async_trait;

    // Provided methods
    fn create_named_key<'life0, 'life1, 'async_trait>(
        &'life0 self,
        key_id: &'life1 str,
        key_type: KeyType,
    ) -> Pin<Box<dyn Future<Output = Result<NewKey, BackendError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait { ... }
    fn create_named_aead<'life0, 'life1, 'async_trait>(
        &'life0 self,
        key_id: &'life1 str,
        aead: AeadAlgorithm,
    ) -> Pin<Box<dyn Future<Output = Result<(), BackendError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait { ... }
    fn public_key_with_meta<'life0, 'life1, 'async_trait>(
        &'life0 self,
        key_id: &'life1 str,
    ) -> Pin<Box<dyn Future<Output = Result<PublicKey, BackendError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait { ... }
    fn key_metadata<'life0, 'life1, 'async_trait>(
        &'life0 self,
        key_id: &'life1 str,
    ) -> Pin<Box<dyn Future<Output = Result<KeyMetadata, BackendError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait { ... }
    fn public_keys<'life0, 'life1, 'async_trait>(
        &'life0 self,
        key_id: &'life1 str,
    ) -> Pin<Box<dyn Future<Output = Result<BTreeMap<u32, Vec<u8>>, BackendError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait { ... }
    fn import<'life0, 'life1, 'life2, 'async_trait>(
        &'life0 self,
        key_id: &'life1 str,
        key_type: KeyType,
        material: &'life2 KeyMaterial,
    ) -> Pin<Box<dyn Future<Output = Result<NewKey, BackendError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait { ... }
    fn sign_with_options<'life0, 'life1, 'life2, 'async_trait>(
        &'life0 self,
        key_id: &'life1 str,
        message: &'life2 [u8],
        options: SignOptions,
    ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, BackendError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait { ... }
    fn verify_with_options<'life0, 'life1, 'life2, 'life3, 'async_trait>(
        &'life0 self,
        key_id: &'life1 str,
        message: &'life2 [u8],
        signature: &'life3 [u8],
        options: SignOptions,
    ) -> Pin<Box<dyn Future<Output = Result<bool, BackendError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait,
             'life3: 'async_trait { ... }
    fn supports_native_algorithm(&self, algorithm: NativeAlgorithm) -> bool { ... }
    fn create_named_pqc_key<'life0, 'life1, 'async_trait>(
        &'life0 self,
        key_id: &'life1 str,
        algorithm: NativeAlgorithm,
    ) -> Pin<Box<dyn Future<Output = Result<NewKey, BackendError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait { ... }
    fn sign_pqc<'life0, 'life1, 'life2, 'async_trait>(
        &'life0 self,
        key_id: &'life1 str,
        message: &'life2 [u8],
        algorithm: NativeAlgorithm,
    ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, BackendError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait { ... }
    fn verify_pqc<'life0, 'life1, 'life2, 'life3, 'async_trait>(
        &'life0 self,
        key_id: &'life1 str,
        message: &'life2 [u8],
        signature: &'life3 [u8],
        algorithm: NativeAlgorithm,
    ) -> Pin<Box<dyn Future<Output = Result<bool, BackendError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait,
             'life3: 'async_trait { ... }
    fn encrypt<'life0, 'life1, 'life2, 'life3, 'async_trait>(
        &'life0 self,
        key_id: &'life1 str,
        algorithm: AeadAlgorithm,
        plaintext: &'life2 [u8],
        aad: Option<&'life3 [u8]>,
    ) -> Pin<Box<dyn Future<Output = Result<CiphertextEnvelope, BackendError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait,
             'life3: 'async_trait { ... }
    fn decrypt<'life0, 'life1, 'life2, 'life3, 'async_trait>(
        &'life0 self,
        key_id: &'life1 str,
        envelope: &'life2 CiphertextEnvelope,
        aad: Option<&'life3 [u8]>,
    ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, BackendError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait,
             'life3: 'async_trait { ... }
    fn rotate<'life0, 'life1, 'async_trait>(
        &'life0 self,
        key_id: &'life1 str,
    ) -> Pin<Box<dyn Future<Output = Result<u32, BackendError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait { ... }
    fn kv_get<'life0, 'life1, 'async_trait>(
        &'life0 self,
        key_id: &'life1 str,
        version: Option<u32>,
    ) -> Pin<Box<dyn Future<Output = Result<KvValue, BackendError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait { ... }
    fn kv_get_secret<'life0, 'life1, 'async_trait>(
        &'life0 self,
        key_id: &'life1 str,
        version: Option<u32>,
    ) -> Pin<Box<dyn Future<Output = Result<KvSecret, BackendError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait { ... }
    fn kv_put<'life0, 'life1, 'life2, 'async_trait>(
        &'life0 self,
        key_id: &'life1 str,
        value: &'life2 [u8],
    ) -> Pin<Box<dyn Future<Output = Result<u32, BackendError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait { ... }
    fn configure_versions<'life0, 'life1, 'async_trait>(
        &'life0 self,
        key_id: &'life1 str,
        min_decryption_version: Option<u32>,
        min_available_version: Option<u32>,
    ) -> Pin<Box<dyn Future<Output = Result<(), BackendError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait { ... }
    fn issue_x509_svid<'life0, 'life1, 'life2, 'async_trait>(
        &'life0 self,
        key_id: &'life1 str,
        spiffe_id: &'life2 str,
        ttl_seconds: u64,
    ) -> Pin<Box<dyn Future<Output = Result<X509Svid, BackendError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait { ... }
    fn issue_x509_cert<'life0, 'life1, 'life2, 'async_trait>(
        &'life0 self,
        key_id: &'life1 str,
        request: &'life2 X509CertRequest,
    ) -> Pin<Box<dyn Future<Output = Result<X509Svid, BackendError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait { ... }
    fn x509_bundle<'life0, 'life1, 'async_trait>(
        &'life0 self,
        key_id: &'life1 str,
    ) -> Pin<Box<dyn Future<Output = Result<X509Bundle, BackendError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait { ... }
}

A pluggable key-store + signing backend.

Implementations must be cheap to share across connections (the agent holds a single Arc<dyn Backend> and clones it into every spawned handler).

Required Methods

fn kind(&self) -> &'static str

Short, stable name for this backend (e.g. "vault"), used in STATUS.

fn new_key<'life0, 'async_trait>( &'life0 self, key_type: KeyType, ) -> Pin<Box<dyn Future<Output = Result<NewKey, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

NEW_KEY creates a new key of key_type and returns its id + public key.

fn public_key<'life0, 'life1, 'async_trait>( &'life0 self, key_id: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Read the raw public key bytes for key_id (for Ed25519, 32 bytes). Used by credential minters (e.g. to derive a NATS issuer NKey).

fn sign<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, key_id: &'life1 str, message: &'life2 [u8], ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

SIGN signs message with key_id, returning the raw signature bytes.

For Ed25519 / ed25519-nkey keys the argument is the raw message, signed directly (EdDSA is not pre-hashed): the backend MUST NOT pre-hash it. This is what lets a NATS client hand Basil the server-issued nonce verbatim and use the returned signature as its connect response (an async-nats remote-signer callback), so the user seed never leaves the vault.

fn verify<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, key_id: &'life1 str, message: &'life2 [u8], signature: &'life3 [u8], ) -> Pin<Box<dyn Future<Output = Result<bool, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

VERIFY verifies signature over message with key_id.

Provided Methods

fn create_named_key<'life0, 'life1, 'async_trait>( &'life0 self, key_id: &'life1 str, key_type: KeyType, ) -> Pin<Box<dyn Future<Output = Result<NewKey, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Create an asymmetric crypto key at a named path (key_id = the catalog transit key name) rather than the server-assigned id [new_key] uses. This is the startup-reconcile (vault-zrg) generate path: the key must exist at the exact catalog path so a later sign/get_public_key resolves to it.

The default returns BackendError::Unsupported; vault overrides it.

fn create_named_aead<'life0, 'life1, 'async_trait>( &'life0 self, key_id: &'life1 str, aead: AeadAlgorithm, ) -> Pin<Box<dyn Future<Output = Result<(), BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Create a symmetric AEAD crypto key at a named path. AEAD suites are not wire KeyTypes, so the reconcile generate path passes aead, the catalog algorithm. There is no public half to return; Ok(()) means the key now exists at key_id.

The default returns BackendError::Unsupported; vault overrides it.

fn public_key_with_meta<'life0, 'life1, 'async_trait>( &'life0 self, key_id: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<PublicKey, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

GET_PUBLIC_KEY: read the public half plus its metadata (algorithm + current version) for key_id.

The default returns BackendError::Unsupported so a backend that only signs need not implement metadata; vault overrides it.

fn key_metadata<'life0, 'life1, 'async_trait>( &'life0 self, key_id: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<KeyMetadata, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Read value-free metadata (algorithm + latest version) for key_id. Used by list to populate each [basil_proto::KeyEntry] without ever reading key material.

The default returns BackendError::Unsupported; vault overrides it.

fn public_keys<'life0, 'life1, 'async_trait>( &'life0 self, key_id: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<BTreeMap<u32, Vec<u8>>, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Read every live version’s public key for key_id, keyed by version number. For a transit key this is the data.keys map, each archived (and the latest) version’s public half, which is the natural multi-version source for a rotation/grace-aware JWKS (basil-uce.2): the shared generator emits one JWK per version still inside the grace window.

Public material only, never any private/secret bytes (the same guarantee as Backend::public_key). The default degrades safely to the single latest version (so non-transit backends that only know “the current public key” still publish a valid one-key set); vault/spiffe override it to return the whole version map.

fn import<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, key_id: &'life1 str, key_type: KeyType, material: &'life2 KeyMaterial, ) -> Pin<Box<dyn Future<Output = Result<NewKey, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

IMPORT (BYOK) creates the key key_id from caller-supplied material.

Write-only: the private material is consumed to provision the key and the reply carries only the public half (never the seed/private bytes). The material variant must agree with key_type.

The default returns BackendError::Unsupported; vault overrides it.

fn sign_with_options<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, key_id: &'life1 str, message: &'life2 [u8], options: SignOptions, ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

SIGN with backend-specific algorithm options.

The default mode preserves the normal Backend::sign behavior. Non- default modes fail closed unless a backend explicitly implements them.

fn verify_with_options<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, key_id: &'life1 str, message: &'life2 [u8], signature: &'life3 [u8], options: SignOptions, ) -> Pin<Box<dyn Future<Output = Result<bool, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

VERIFY with backend-specific algorithm options.

The default mode preserves the normal Backend::verify behavior. Non- default modes fail closed unless a backend explicitly implements them.

fn supports_native_algorithm(&self, algorithm: NativeAlgorithm) -> bool

Whether this backend can perform algorithm natively in place: custody the private key inside the backend and run the operation without ever materializing the seed locally.

This is the capability probe behind the backend-preferred / backend-required provider policy (basil-wuj.10). It is cheap, synchronous, and fails closed: the default, and any backend that does not override it (every shipping Vault/OpenBao transit engine today, none of which has ML-DSA transit), returns false, so an unknown or unsupported capability never routes key material to a backend that cannot custody it. A backend that returns true here MUST implement the matching native operation methods (Self::sign_pqc, Self::verify_pqc, Self::create_named_pqc_key).

fn create_named_pqc_key<'life0, 'life1, 'async_trait>( &'life0 self, key_id: &'life1 str, algorithm: NativeAlgorithm, ) -> Pin<Box<dyn Future<Output = Result<NewKey, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Provision a new backend-native ML-DSA key at the named key_id, returning only its public half. The private seed is generated and kept inside the backend and is never returned. Invoked by the backend-native crypto provider when Self::supports_native_algorithm reports support.

The default returns BackendError::Unsupported; a backend with native ML-DSA transit overrides it.

fn sign_pqc<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, key_id: &'life1 str, message: &'life2 [u8], algorithm: NativeAlgorithm, ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

SIGN message with a backend-native ML-DSA key, returning the raw signature bytes. The private seed never leaves the backend.

The default returns BackendError::Unsupported; a backend with native ML-DSA transit overrides it.

fn verify_pqc<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, key_id: &'life1 str, message: &'life2 [u8], signature: &'life3 [u8], algorithm: NativeAlgorithm, ) -> Pin<Box<dyn Future<Output = Result<bool, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

VERIFY signature over message with a backend-native ML-DSA key, using only the public half.

The default returns BackendError::Unsupported; a backend with native ML-DSA transit overrides it.

fn encrypt<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, key_id: &'life1 str, algorithm: AeadAlgorithm, plaintext: &'life2 [u8], aad: Option<&'life3 [u8]>, ) -> Pin<Box<dyn Future<Output = Result<CiphertextEnvelope, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

ENCRYPT: AEAD-encrypt plaintext under key_id’s latest version, binding aad if present, and return a normalized CiphertextEnvelope.

The broker never takes a caller nonce: the backend (transit) generates a fresh nonce per call. algorithm must match the key’s catalog keyType (the manager enforces that before dispatch); the envelope echoes it.

The default returns BackendError::Unsupported; [transit] overrides it.

fn decrypt<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, key_id: &'life1 str, envelope: &'life2 CiphertextEnvelope, aad: Option<&'life3 [u8]>, ) -> Pin<Box<dyn Future<Output = Result<Vec<u8>, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

DECRYPT: AEAD-decrypt envelope under key_id, binding aad if present, and return the recovered plaintext.

The envelope’s key_version targets the version that produced it (so a ciphertext made before a rotation still decrypts during the grace window). A tag/AAD/version mismatch is BackendError::DecryptFailed: opaque, no oracle.

The default returns BackendError::Unsupported; [transit] overrides it.

fn rotate<'life0, 'life1, 'async_trait>( &'life0 self, key_id: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<u32, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

ROTATE: bump key_id to a fresh transit key version, returning the new (now-latest) version number. New encrypt/sign always uses the newest version; older versions remain decryptable/verifiable within the grace window (see Backend::configure_versions).

The default returns BackendError::Unsupported; [transit] overrides it.

fn kv_get<'life0, 'life1, 'async_trait>( &'life0 self, key_id: &'life1 str, version: Option<u32>, ) -> Pin<Box<dyn Future<Output = Result<KvValue, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Read a KV-v2 value for key_id: the stored bytes plus the version they came from. version = None reads the latest version; Some(v) reads that specific version. This is the residual value-returning get path (§7) and is only ever routed to a value/public-class key by the manager. It never reads transit (crypto-key) material.

The default returns BackendError::Unsupported; [transit] overrides it.

fn kv_get_secret<'life0, 'life1, 'async_trait>( &'life0 self, key_id: &'life1 str, version: Option<u32>, ) -> Pin<Box<dyn Future<Output = Result<KvSecret, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Read a KV-v2 value as a SECRET: the stored bytes wrapped in Zeroizing end-to-end, never landing in a non-zeroizing owner that drops un-wiped. Distinct from Backend::kv_get, which returns a plain KvValue for public/probe reads, this path serves the materialize reads (materialize_sealing_private / materialize_signing_seed, where the bytes are a private key) and the value-class get (where the bytes are a stored secret). The returned buffer wipes on drop.

The default returns BackendError::Unsupported; [transit] overrides it.

fn kv_put<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, key_id: &'life1 str, value: &'life2 [u8], ) -> Pin<Box<dyn Future<Output = Result<u32, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Write value as a fresh KV-v2 version of key_id, returning the new version number (never the value). Used to rotate a value key that has a catalog generate recipe: the broker generates a fresh value and stores it as the next version (the vault-a2p decision), and to back the set op.

The default returns BackendError::Unsupported; [transit] overrides it.

fn configure_versions<'life0, 'life1, 'async_trait>( &'life0 self, key_id: &'life1 str, min_decryption_version: Option<u32>, min_available_version: Option<u32>, ) -> Pin<Box<dyn Future<Output = Result<(), BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Set the transit version window for key_id: min_decryption_version bounds the grace period (the oldest version decrypt/verify may still target: 0/1 honors all live versions, a higher value rejects pre-window ciphertexts), and min_available_version is the retention floor (transit deletes archived key material below it, irreversibly pruning expired versions). Both are optional; None leaves that field untouched.

The default returns BackendError::Unsupported; [transit] overrides it.

fn issue_x509_svid<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, key_id: &'life1 str, spiffe_id: &'life2 str, ttl_seconds: u64, ) -> Pin<Box<dyn Future<Output = Result<X509Svid, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Issue an X.509-SVID leaf from a provider-native PKI role.

key_id is the backend-native issue endpoint from the catalog. For Vault PKI this is an absolute path such as pki/issue/web, not a transit key name. The private key is scoped to this operation and carried in a zeroizing buffer until the Workload API response is assembled.

fn issue_x509_cert<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, key_id: &'life1 str, request: &'life2 X509CertRequest, ) -> Pin<Box<dyn Future<Output = Result<X509Svid, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Issue a DNS/IP-SAN X.509 leaf (a TLS cert) from a provider-native PKI role.

key_id is the backend-native issue endpoint from the catalog (for Vault PKI, an absolute path such as pki/issue/web). Like Backend::issue_x509_svid the issuing CA key never leaves the backend; unlike an SVID the leaf is bound to DNS/IP SANs, and the leaf private key is returned to the caller (a TLS server needs it) in a zeroizing buffer.

fn x509_bundle<'life0, 'life1, 'async_trait>( &'life0 self, key_id: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<X509Bundle, BackendError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Read trust-domain X.509 bundle material from a provider-native PKI issuer path.

key_id is the same backend-native locator used by Backend::issue_x509_svid. For Vault PKI this is an issue path such as pki/issue/web; the backend derives the PKI mount and reads that mount’s CA bundle and CRL.

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors

impl Backend for SpiffeVaultBackend

impl Backend for VaultBackend