Enum ActionType 

#[non_exhaustive]
pub enum ActionType {
    ClockCheck,
    Confirm,
    CheckValue,
    OralReadback,
    MachineInfo,
    GenerateKey,
    WrapKey,
    UnwrapKey,
    ExportPublic,
    SignData,
    VerifySignature,
    Attest,
    GatherEntropy,
    TpmAttest,
    PivReadCertificate,
    PivSign,
    YubikeyAttestSlot,
    IssueCertificate,
    GenerateCsr,
}

Action types available in ceremony steps.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

ClockCheck

Verify system clock is correct before ceremony proceeds.

Displays current time and requires operator confirmation. Should be placed as the first step to ensure all timestamps are valid.

Confirm

Human attests to something with yes/no decision (single person).

Use when the verification requires human judgment about external state. Example: “Verify all network cables are disconnected”.

CheckValue

Machine compares two known values and records pass/fail (automatic).

Use when both values are known to the system and comparison is deterministic. Example: Compare computed SHA-256 hash against expected value.

OralReadback

Two-party verbal verification: reader speaks value aloud, confirmer verifies.

Use when a value must be verified against something external (physical label, document). Supports NATO phonetic alphabet and hex formatting.

MachineInfo

Capture machine information (hostname, CPU, OS) as evidence.

Records device identity to prove which machine ran the ceremony. Should be placed early in ceremony to establish machine context.

GenerateKey

Generate a key: a keypair for an asymmetric algorithm, one secret for a symmetric one.

WrapKey

Encrypt a private key under another key so it can leave the machine.

The OpenSSL backend produces a CMS AuthEnvelopedData under AES-256-GCM. Which encapsulation that takes follows the recipient key, and the transcript records what the wrap actually did.

Reads wrapping_key: to wrap under a key the backend holds, or recipient: to wrap to a public key held outside the ceremony.

UnwrapKey

Decrypt a wrapped key and import it into a backend under a new label.

ExportPublic

Export public key from keypair.

SignData

Sign arbitrary data with a backend-managed key.

The signature algorithm follows from the key unless algorithm: names another one the key accepts. Requires a backend implementing SignBackend.

VerifySignature

Verify a signature over data, given the signer’s public key.

Needs no backend: verification takes only a public key, so it works on evidence the ceremony did not produce. The key may be a bare public key or a certificate carrying one. Naming a backend: delegates the check to that backend instead.

Attest

Formal attestation statement.

GatherEntropy

Fold human-supplied entropy into the ceremony seed.

A participant supplies a free-form random value (for example, the result of rolling physical dice), which is mixed into the entropy source’s ratchet. Any later drawn value reflects the contribution and stays re-derivable by rite verify.

TpmAttest

TPM attestation with PCR measurements and cryptographic quotes.

Requires the rite-tpm backend.

PivReadCertificate

Read X.509 certificate from PIV smart card slot.

No PIN required; reading certificates is unauthenticated on PIV cards. Requires a PIV backend.

PivSign

Sign data using PIV smart card on-device key.

Handles PIN verification internally before signing. Requires a PIV backend.

YubikeyAttestSlot

Generate a YubiKey attestation certificate for a PIV slot (Yubico extension).

Slot F9 signs the key’s certificate to prove it was generated on-device. Requires the rite-yubikey backend.

IssueCertificate

Issue an X.509 certificate from a PKCS#10 CSR.

Takes a CSR and a backend-managed signing key, assembles the TBSCertificate, signs it via the backend’s SignBackend, and produces a DER-encoded certificate. Works with any backend implementing SignBackend (software, PKCS#11, YubiKey).

GenerateCsr

Generate a PKCS#10 CSR signed by a backend-managed key.

Takes a backend-managed signing key and subject parameters, assembles a CertReqInfo, signs it via the backend’s SignBackend, and produces a DER-encoded CSR.

Implementations

impl ActionType

pub const ALL: &'static [ActionType]

Every action type, for callers that need to enumerate them.

Maintained by hand: #[non_exhaustive] means no downstream crate can derive this list, and adding a variant produces no error outside this crate. Adding one here is what keeps editor completion and any other catalogue from silently missing it. The test below catches omissions.

pub fn backend_usage(self) -> BackendUsage

How this action relates to the backend: field on its step.

TODO: Replace this with a nested enum split — ActionType::Backend(BackendAction) vs ActionType::Local(LocalAction), once a home is found for the actions that are neither. This is a breaking change to every match on ActionType variants.

pub fn required_with_fields(self) -> &'static [&'static str]

Returns the with: field names that are required for this action.

The resolver reports a diagnostic for each missing field.

TODO: Replace the stringly-typed with: serde_json::Value in schema::StepBody with a typed WithFields enum (one variant per action, carrying its required fields as named struct members). Serde would then enforce required fields at parse time and this method would no longer be needed. This is a breaking change to the schema and lowering layers.

pub fn known_with_fields(self) -> &'static [&'static str]

Every with: key this action accepts.

Nothing else may appear under with:. Serde ignores a key it does not know, so without this a misspelled field, or one that used to exist, is dropped in silence and the ceremony quietly stops doing what its author wrote. That is the failure this list exists to prevent, and it covers typos and removed fields alike rather than naming them one at a time.

Required keys are the subset in required_with_fields; the rest are optional. Nested keys are not listed: only the top level of the block is checked, because a nested shape belongs to the handler’s own params type.

pub fn reads_contract(self) -> ReadsContract

Returns the reads: inputs this action requires, and the groups from which exactly one input must be named.

A group is how an action offers two paths over the same operation. The input the author names selects the path, so naming both is ambiguous and naming neither leaves the path undetermined. The resolver reports either on the step.

pub fn describe(&self) -> &'static str

Short human-readable description of what this action does.

Used as fallback prose in script generation, TUI step display, and LSP hover when no explicit description or message parameter is present.

Trait Implementations

impl Clone for ActionType

fn clone(&self) -> ActionType

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for ActionType

impl Debug for ActionType

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ActionType

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Display for ActionType

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for ActionType

impl Hash for ActionType

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for ActionType

fn eq(&self, other: &ActionType) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for ActionType

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for ActionType