Struct KeyRing 

pub struct KeyRing { /* private fields */ }

The public keys an agent trusts, keyed by kid.

Implementations

impl KeyRing

pub fn new() -> Self

pub fn insert( &mut self, kid: impl Into<String>, key: VerifyingKey, policy: KeyPolicy, )

pub fn is_empty(&self) -> bool

pub fn get(&self, kid: &str) -> Option<(&str, &VerifyingKey, &KeyPolicy)>

Look a key up, yielding the ring’s own kid string so a verified result borrows from the trusted ring rather than from the attacker- supplied header it was matched against.

pub fn kids(&self) -> impl Iterator<Item = &str>

Every kid on the ring, for reporting which keys an agent holds.

pub fn kid_fingerprints(&self) -> impl Iterator<Item = String>

Every entry as kid:fingerprint, which is what the heartbeat reports.

The kid alone cannot answer “do two machines holding the same id hold the same key” (#1229). A ring entry with the right id and wrong bytes refuses every command once enforcement is on, and does not self-heal — the reload-on-unknown-key path never fires, because the key is present, just wrong. Carrying the fingerprint makes that state visible from the fleet view instead of only on the host.

Trait Implementations

impl Clone for KeyRing

fn clone(&self) -> KeyRing

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for KeyRing

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for KeyRing

fn default() -> KeyRing

Returns the “default value” for a type.