Struct SignerHandle 

pub struct SignerHandle { /* private fields */ }

Handle to a signing backend. Obtained from create_signer().

Multi-key: each method takes a label parameter. The factory initializes the backend and ensures the default_key_label exists.

Implementations

impl SignerHandle

pub fn generate_key(&self, label: &str, policy: AccessPolicy) -> Result<Vec<u8>>

Generate a new P-256 signing key. Returns uncompressed SEC1 public key.

Errors

• Error::DuplicateLabel if a key with this label already exists.
• Error::InvalidLabel if the label is empty, too long, or contains illegal characters.
• Error::PolicyNotSupported if the backend cannot enforce the requested AccessPolicy.
• Error::RequiresSigning if policy requires a code-signed binary.
• Error::KeyOperation for underlying hardware or I/O failures.

pub fn public_key(&self, label: &str) -> Result<Vec<u8>>

Return the uncompressed SEC1 public key for an existing key.

pub fn sign(&self, label: &str, data: &[u8]) -> Result<Vec<u8>>

Sign data (SHA-256 applied internally). Returns a DER-encoded ECDSA P-256 signature.

Errors

• Error::KeyNotFound if no key with this label exists.
• Error::AuthDenied if the keychain ACL denies access to the wrapping key.
• Error::AuthRequired if the device is locked or the GUI session is absent.
• Error::UserCancelled if the user dismissed a biometric prompt.
• Error::SignFailed for underlying hardware or crypto failures.

pub fn sign_with_presence( &self, label: &str, data: &[u8], opts: &PresenceOptions, ) -> Result<Vec<u8>>

Sign data with an optional user-presence prompt.

• PresenceMode::Strict on a platform where presence_available() is false returns Error::PresenceNotAvailable.
• PresenceMode::Cached or PresenceMode::None always falls through to a plain sign on non-macOS platforms (no error).

Errors

• Error::PresenceNotAvailable if opts.mode is Strict and the platform has no user-presence support.
• Error::KeyNotFound if no key with this label exists.
• Error::AuthDenied if the keychain ACL denies access to the wrapping key.
• Error::AuthRequired if the device is locked or the GUI session is absent.
• Error::UserCancelled if the user dismissed a biometric prompt.
• Error::SignFailed for underlying hardware or crypto failures.

pub fn presence_available(&self) -> bool

True when the current platform supports presence prompting.

pub fn list_keys(&self) -> Result<Vec<KeyInfo>>

List all signing keys in this app’s key store.

pub fn delete_key(&self, label: &str) -> Result<()>

Permanently delete a signing key and its metadata.

pub fn key_exists(&self, label: &str) -> Result<bool>

Return true if a key with this label exists.

pub fn rename_key(&self, old_label: &str, new_label: &str) -> Result<()>

Atomically rename a signing key.

pub fn evict_presence_cache(&self, label: &str)

Evict the cached wrapping-key / LAContext for label, forcing the next sign to re-authenticate. Has no effect on platforms without presence caching.

pub fn backend_kind(&self) -> BackendKind

Which hardware security backend backs this handle.

Trait Implementations

impl Debug for SignerHandle

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.