Struct SigningKey 

#[non_exhaustive]
pub struct SigningKey {
    pub kid: String,
    pub principal_id: PrincipalId,
    pub public_key: [u8; 32],
    pub status: SigningKeyStatus,
    pub created_at: i64,
    pub retire_at: Option<i64>,
}

One Ed25519 keypair (public half + lifecycle metadata) belonging to a service principal.

public_key is the raw 32-byte Ed25519 public key (PASETO V4’s AsymmetricPublicKey<V4>::as_bytes() shape). It is the only key half cheers retains: the secret half is returned exactly once at provision/rotate time in ProvisionedKey::secret_key and never again.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

kid: String

Stable opaque identifier — the JWKS rotation handle. Unique across the JWKS (not just within one principal); kamaji matches against kid and falls back to a rate-limited refresh on unknown values.

principal_id: PrincipalId

Service principal this key signs for. kind is always PrincipalKind::Service — provision/rotate refuse other kinds at the authority layer.

public_key: [u8; 32]

Raw Ed25519 public key — 32 bytes. Serialized to the JWKS as base64url; in this struct kept as the byte array so a JWKS publisher (R020-F11) doesn’t have to re-decode.

status: SigningKeyStatus

created_at: i64

retire_at: Option<i64>

None while the key is Active. Set to the unix-second drop time when the key transitions to Retiring — prune_retired_keys removes rows whose retire_at <= now.

Implementations

impl SigningKey

pub fn new( kid: impl Into<String>, principal_id: PrincipalId, public_key: [u8; 32], status: SigningKeyStatus, created_at: i64, retire_at: Option<i64>, ) -> Self

Build a SigningKey from its persisted parts.

Provided so external ServicePrincipalStore impls (cheers-sqlx, cheers-redis, …) can reconstruct rows without depending on the #[non_exhaustive] struct expression — that compiles only from inside this crate.

Trait Implementations

impl Clone for SigningKey

fn clone(&self) -> SigningKey

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SigningKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SigningKey

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for SigningKey

impl PartialEq for SigningKey

fn eq(&self, other: &SigningKey) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for SigningKey

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for SigningKey