Enum ControlCommand 

pub enum ControlCommand {
    PrepareUpgrade {
        payload: Vec<u8>,
        payload_signature: Vec<u8>,
        rekey: Option<RekeyParams>,
        nonce: [u8; 32],
    },
    RevokeUpgrade {
        payload: Vec<u8>,
        payload_signature: Vec<u8>,
        rollback: bool,
        nonce: [u8; 32],
    },
}

Inner payload of a signed control command. Serialized as CBOR before signing — the wire-level signature covers the exact bytes the verifier then deserializes, so re-encoding skew can’t break verification.

Wire-stability note

PrepareUpgrade was redesigned as part of the public upgrade-chain work. There were no live senders of the previous shape (new_public_key / new_key_id / nonce), so the wire change is safe. The new shape carries the chain artifact inline so the enclave can emit the chain link as part of the same atomic operation as the storage re-key, before replying to the backend.

Variants

PrepareUpgrade

Staged-upgrade confirmation. The enclave verifies the envelope signature, optionally re-keys storage, emits a chain Upgrade link to chain-host, and replies success.

Fields

payload: Vec<u8>

CBOR-encoded chain::UpgradePayload. Becomes the payload field of the chain link verbatim; the enclave must not re-encode it.

payload_signature: Vec<u8>

64-byte raw r||s ECDSA P-256 signature over payload under the enclave’s control private key. Becomes the signature field of the chain link. The enclave MAY also verify this against its own control public key as defence-in-depth (same key signs both the envelope and the chain payload).

rekey: Option<RekeyParams>

Storage re-key parameters. None for stateless enclaves.

nonce: [u8; 32]

Single-use per-boot nonce, must equal the server’s current nonce. Prevents replay across boots without relying on clocks.

RevokeUpgrade

Pre-activation revocation. The enclave verifies the envelope signature, optionally rolls back the LUKS keyslot added at PrepareUpgrade time, emits a chain Revocation link to chain-host, and replies success.

Fields

payload: Vec<u8>

CBOR-encoded chain::RevocationPayload. Becomes the payload field of the chain link verbatim.

payload_signature: Vec<u8>

64-byte raw r||s ECDSA P-256 signature over payload. Becomes the chain link signature.

rollback: bool

When true, the enclave runs enclavia-crypto revoke-upgrade to kill the LUKS keyslot added at prepare time and restore the key blob to its pre-prepare state. false for stateless enclaves.

nonce: [u8; 32]

Single-use per-boot nonce.

Trait Implementations

impl Clone for ControlCommand

fn clone(&self) -> ControlCommand

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ControlCommand

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ControlCommand

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for ControlCommand

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.