pigeon/commands/keyring/
encryption_key.rs

1use serde::{Deserialize, Serialize};
2
3/// A configured symmetric encryption key's metadata, including its secret
4/// key material as a plain field (ADR-0026, secret storage per ADR-0135) --
5/// `keyring.toml` is this entry's sole storage since ADR-0135 retired the OS
6/// keychain, protected only by `Store::save`'s `0600` file permissions.
7/// Deliberately has no `#[serde(default)]` on `key_hex`: a pre-ADR-0135
8/// entry with no secret field fails to parse loudly rather than silently
9/// loading an empty key.
10#[derive(Debug, Clone, Serialize, Deserialize)]
11pub struct EncryptionKey {
12    pub alias: String,
13    /// RFC3339, set once at creation; never updated by `modify` -- rotating
14    /// the secret changes the key, not when the entry was made.
15    pub created_at: String,
16    /// 64 hex characters (32 bytes / 256 bits). See
17    /// `crate::core::keyring::credentials::resolve_secret` for the one
18    /// remaining override (ADR-0087's `PIGEON_SECRET_<ALIAS>`).
19    pub key_hex: String,
20}
21
22impl crate::core::keyring::KeyringEntry for EncryptionKey {
23    fn alias(&self) -> &str {
24        &self.alias
25    }
26    fn kind(&self) -> &'static str {
27        "encryption-key"
28    }
29    fn detail(&self) -> String {
30        format!("created {}", self.created_at)
31    }
32}
pigeon/commands/keyring/encryption_key.rs

pigeon/commands/keyring/
encryption_key.rs
