Enum ActionType 

#[non_exhaustive]
pub enum ActionType {
    ClockCheck,
    Confirm,
    CheckValue,
    OralReadback,
    MachineInfo,
    GenerateKeypair,
    WrapKey,
    UnwrapKey,
    ExportPublic,
    Attest,
    GatherEntropy,
    TpmAttest,
    PivReadCertificate,
    PivSign,
    YubikeyAttestSlot,
    IssueCertificate,
    GenerateCsr,
}

Action types available in ceremony steps.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

ClockCheck

Verify system clock is correct before ceremony proceeds.

Displays current time and requires operator confirmation. Should be placed as the first step to ensure all timestamps are valid.

Confirm

Human attests to something with yes/no decision (single person).

Use when the verification requires human judgment about external state. Example: “Verify all network cables are disconnected”.

CheckValue

Machine compares two known values and records pass/fail (automatic).

Use when both values are known to the system and comparison is deterministic. Example: Compare computed SHA-256 hash against expected value.

OralReadback

Two-party verbal verification: reader speaks value aloud, confirmer verifies.

Use when a value must be verified against something external (physical label, document). Supports NATO phonetic alphabet and hex formatting.

MachineInfo

Capture machine information (hostname, CPU, OS) as evidence.

Records device identity to prove which machine ran the ceremony. Should be placed early in ceremony to establish machine context.

GenerateKeypair

Generate RSA or EC keypair.

WrapKey

Wrap key using CMS EnvelopedData.

UnwrapKey

Unwrap key using CMS EnvelopedData.

ExportPublic

Export public key from keypair.

Attest

Formal attestation statement.

GatherEntropy

Fold human-supplied entropy into the ceremony seed.

A participant supplies a free-form random value (for example, the result of rolling physical dice), which is mixed into the entropy source’s ratchet. Any later drawn value reflects the contribution and stays re-derivable by rite verify.

TpmAttest

TPM attestation with PCR measurements and cryptographic quotes.

Requires the rite-tpm backend.

PivReadCertificate

Read X.509 certificate from PIV smart card slot.

No PIN required; reading certificates is unauthenticated on PIV cards. Requires a PIV backend.

PivSign

Sign data using PIV smart card on-device key.

Handles PIN verification internally before signing. Requires a PIV backend.

YubikeyAttestSlot

Generate a YubiKey attestation certificate for a PIV slot (Yubico extension).

Slot F9 signs the key’s certificate to prove it was generated on-device. Requires the rite-yubikey backend.

IssueCertificate

Issue an X.509 certificate from a PKCS#10 CSR.

Takes a CSR and a backend-managed signing key, assembles the TBSCertificate, signs it via the backend’s SignBackend, and produces a DER-encoded certificate. Works with any backend implementing SignBackend (software, PKCS#11, YubiKey).

GenerateCsr

Generate a PKCS#10 CSR signed by a backend-managed key.

Takes a backend-managed signing key and subject parameters, assembles a CertReqInfo, signs it via the backend’s SignBackend, and produces a DER-encoded CSR.

Implementations

impl ActionType

pub fn requires_backend(self) -> bool

Returns true if this action requires a backend: field in the step.

TODO: Replace this with a nested enum split — ActionType::Backend(BackendAction) vs ActionType::Local(LocalAction). The requires_backend check then becomes matches!(self, ActionType::Backend(_)) with no hardcoded list, and each group gains its own impl block. This is a breaking change to every match on ActionType variants.

pub fn required_with_fields(self) -> &'static [&'static str]

Returns the with: field names that are required for this action.

The resolver reports a diagnostic for each missing field.

TODO: Replace the stringly-typed with: serde_json::Value in schema::StepBody with a typed WithFields enum (one variant per action, carrying its required fields as named struct members). Serde would then enforce required fields at parse time and this method would no longer be needed. This is a breaking change to the schema and lowering layers.

pub fn describe(&self) -> &'static str

Short human-readable description of what this action does.

Used as fallback prose in script generation, TUI step display, and LSP hover when no explicit description or message parameter is present.

Trait Implementations

impl Clone for ActionType

fn clone(&self) -> ActionType

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for ActionType

impl Debug for ActionType

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ActionType

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Display for ActionType

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for ActionType

impl Hash for ActionType

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for ActionType

fn eq(&self, other: &ActionType) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for ActionType

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for ActionType