Struct KeyRing 

pub struct KeyRing { /* private fields */ }

The current key, plus any retired ones still needed to read old payloads.

Rotation is the whole point. Adding a key to the front of the ring means everything written from then on uses it, while everything already written still decrypts — so a rotation is a deploy, not a migration.

Implementations

impl KeyRing

pub fn new(current: Key) -> Self

A ring with one key.

pub fn with_previous(self, key: Key) -> Self

Add a retired key, usable for decryption only.

Order among retired keys does not matter; lookup is by id.

pub fn from_base64(current: &str, previous: &[String]) -> Result<Self>

Build from an application key and any number of retired ones.

pub fn current(&self) -> &Key

The key new payloads are written with.

pub fn find(&self, id: &str) -> Option<&Key>

The key with this id, if the ring still holds it.

pub fn len(&self) -> usize

How many keys the ring holds, current included.

pub fn is_empty(&self) -> bool

Always false — a ring is constructed with a current key.

pub fn all(&self) -> impl Iterator<Item = &Key>

Every key, current first.

For a payload format that carries no key id and can only be decrypted by trying — the PHP envelope, for one. Rainier’s own format names its key, so it uses find instead.

pub fn ids(&self) -> Vec<&str>

Every key id, current first. For a diagnostic command.

Trait Implementations

impl Clone for KeyRing

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for KeyRing

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.