Enum KeySource 

pub enum KeySource<'a> {
    File(&'a Path),
    Material(&'a str),
}

Where the key comes from, when one is offered at all.

A type rather than two Options so the two cannot both be set, and so the call site reads as the choice it is. Both go through the same parser and the same refusals; only the reading differs.

Variants

File(&'a Path)

A file written by export-key.

Material(&'a str)

The text of such a file, handed over directly.

Visible in the process list for as long as the command runs, and kept for ever in the shell’s history — measured on macOS: ps -ww -o command -p <pid> prints the material verbatim. That is the price of the one thing a file cannot do, which is arrive from a CI secret without ever being written to disk, and it is the caller’s to pay knowingly. The binary says so on stderr every time.

Trait Implementations

impl<'a> Clone for KeySource<'a>

fn clone(&self) -> KeySource<'a>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<'a> Copy for KeySource<'a>

impl<'a> Debug for KeySource<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.