Enum ActionType 

#[non_exhaustive]
pub enum ActionType {
    ClockCheck,
    Confirm,
    CheckValue,
    OralReadback,
    Reveal,
    MachineInfo,
    EnterValue,
    EnterSecret,
    GenerateKey,
    WrapKey,
    UnwrapKey,
    EncryptData,
    DecryptData,
    SplitSecret,
    CombineShares,
    EnterShare,
    ImportKey,
    ExportPublic,
    SignData,
    VerifySignature,
    Attest,
    GatherEntropy,
    TpmAttest,
    PivReadCertificate,
    PivSign,
    YubikeyAttestSlot,
    IssueCertificate,
    GenerateCsr,
}

Action types available in ceremony steps.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

ClockCheck

Verify system clock is correct before ceremony proceeds.

Displays current time and requires operator confirmation. Should be placed as the first step to ensure all timestamps are valid.

Confirm

Human attests to something with yes/no decision (single person).

Use when the verification requires human judgment about external state. Example: “Verify all network cables are disconnected”.

CheckValue

Machine compares two known values and records pass/fail (automatic).

Use when both values are known to the system and comparison is deterministic. Example: Compare computed SHA-256 hash against expected value.

OralReadback

Two-party verbal verification: reader speaks value aloud, confirmer verifies.

Use when a value must be verified against something external (physical label, document). Supports NATO phonetic alphabet and hex formatting.

Reveal

Show a value on screen for a person to write down, then withdraw it.

Reads value:, a share or any byte artifact, and shows it in a chosen encoding while a prompt is up; on acknowledgement it is gone. The transcript records that the value was shown and nothing of it. rite script prints a page for the step, one box per character in rows, the parity cells set apart.

MachineInfo

Capture machine information (hostname, CPU, OS) as evidence.

Records device identity to prove which machine ran the ceremony. Should be placed early in ceremony to establish machine context.

EnterValue

A person types a value the ceremony needs and can record: a serial number read off a device, an address shown on a screen.

The value becomes a text artifact, so a later step compares it or prints it, and the transcript carries it. format: and the length fields say what shape the value has, so a slip is refused at the keyboard rather than found at the end.

EnterSecret

A person types a secret the ceremony needs and must not record: a passphrase, a PIN.

enter_value for a value the transcript may not carry. Echo is off, the artifact is held wiped in memory, and the transcript records that a secret was entered at this step and nothing derived from it. A step names it in reads:, which borrows the value. An expression in with: copies it into the step’s parameters, as it would opened content.

GenerateKey

Generate a key: a keypair for an asymmetric algorithm, one secret for a symmetric one.

WrapKey

Encrypt a private key under another key so it can leave the machine.

The OpenSSL backend produces a CMS AuthEnvelopedData under AES-256-GCM. Which encapsulation that takes follows the recipient key, and the transcript records what the wrap actually did.

Reads wrapping_key: to wrap under a key the backend holds, or recipient: to wrap to a public key held outside the ceremony.

UnwrapKey

Decrypt a wrapped key and import it into a backend under a new label.

EncryptData

Encrypt content for a recipient, producing an encrypted-data artifact.

wrap_key for bytes that are not a key. The container is the same one, and the claim is not: a wrap says a key left a backend under protection, while encrypted content makes no custody claim at all.

Reads encryption_key:, a key-encryption key the backend holds. The key protects a fresh content-encryption key, and the content is encrypted under that.

DecryptData

Decrypt an encrypted-data artifact back to bytes.

The bytes become an ordinary artifact, so a later step reads them as a material: import_key lifts them into a key, check_value compares them, sign_data signs them.

SplitSecret

Split a secret into shares of which a threshold reconstruct it.

Shamir over GF(2^8), the rite-sss/v1 format, with the polynomial coefficients drawn from the step’s backend. Reads secret: and creates one artifact holding every share, reached as ${artifact.<name>.share_N} under a later step’s reads:. At most 100 shares. Every subset of threshold shares is combined and checked before the step completes, so a share that leaves the room has been shown to work; a split with more than 100,000 such subsets is refused at run time.

CombineShares

Reconstruct a secret from shares split_secret made.

Reads shares:, a list of at least two, each a share of a set or a share a custodian typed back. Each share records how many are needed, so too few shares is an error before anything is computed. The result stays in memory and is erased when the run ends, like the content decrypt_data opens.

EnterShare

Type a share back from its sheet, row by row.

Each row is checked as it is typed: a wrong character is corrected and named, two unreadable ones are recovered, and a row that needs more is typed again. Rows that are not a share are refused before the step ends. Creates a share combine_shares reads, named without a share_N property. The transcript records the share’s index and which rows were repaired, never the rows.

ImportKey

Install key material the ceremony holds as a key of a named algorithm.

unwrap_key without the decrypt. The bytes can be a material carried into the room or an artifact an earlier step produced, and algorithm: says how to read them, because raw material says nothing about itself.

ExportPublic

Export public key from keypair.

SignData

Sign arbitrary data with a backend-managed key.

The signature algorithm follows from the key unless algorithm: names another one the key accepts. Requires a backend implementing SignBackend.

VerifySignature

Verify a signature over data, given the signer’s public key.

Needs no backend: verification takes only a public key, so it works on evidence the ceremony did not produce. The key may be a bare public key or a certificate carrying one. Naming a backend: delegates the check to that backend instead.

Attest

Formal attestation statement.

GatherEntropy

Fold human-supplied entropy into the ceremony seed.

A participant supplies a free-form random value (for example, the result of rolling physical dice), which is mixed into the entropy source’s ratchet. Any later drawn value reflects the contribution and stays re-derivable by rite verify.

TpmAttest

TPM attestation with PCR measurements and cryptographic quotes.

Requires the rite-tpm backend.

PivReadCertificate

Read X.509 certificate from PIV smart card slot.

No PIN required; reading certificates is unauthenticated on PIV cards. Requires a PIV backend.

PivSign

Sign data using PIV smart card on-device key.

Handles PIN verification internally before signing. Requires a PIV backend.

YubikeyAttestSlot

Generate a YubiKey attestation certificate for a PIV slot (Yubico extension).

Slot F9 signs the key’s certificate to prove it was generated on-device. Requires the rite-yubikey backend.

IssueCertificate

Issue an X.509 certificate from a PKCS#10 CSR.

Takes a CSR and a backend-managed signing key, assembles the TBSCertificate, signs it via the backend’s SignBackend, and produces a DER-encoded certificate. Works with any backend implementing SignBackend (software, PKCS#11, YubiKey).

GenerateCsr

Generate a PKCS#10 CSR signed by a backend-managed key.

Takes a backend-managed signing key and subject parameters, assembles a CertReqInfo, signs it via the backend’s SignBackend, and produces a DER-encoded CSR.

Implementations

impl ActionType

pub const ALL: &'static [ActionType]

Every action type, for callers that need to enumerate them.

Maintained by hand: #[non_exhaustive] means no downstream crate can derive this list, and adding a variant produces no error outside this crate. Adding one here is what keeps editor completion and any other catalogue from silently missing it. The test below catches omissions.

pub fn backend_usage(self) -> BackendUsage

How this action relates to the backend: field on its step.

TODO: Replace this with a nested enum split — ActionType::Backend(BackendAction) vs ActionType::Local(LocalAction), once a home is found for the actions that are neither. This is a breaking change to every match on ActionType variants.

pub fn creates_shares(self) -> bool

Whether the artifact this action creates is shares of a secret, which rite check tells from the step that made it, since the definition does not say what kind an artifact is.

pub fn required_with_fields(self) -> &'static [&'static str]

Returns the with: field names that are required for this action.

The resolver reports a diagnostic for each missing field.

TODO: Replace the stringly-typed with: serde_json::Value in schema::StepBody with a typed WithFields enum (one variant per action, carrying its required fields as named struct members). Serde would then enforce required fields at parse time and this method would no longer be needed. This is a breaking change to the schema and lowering layers.

pub fn known_with_fields(self) -> &'static [&'static str]

Every with: key this action accepts.

Nothing else may appear under with:. Serde ignores a key it does not know, so without this a misspelled field, or one that used to exist, is dropped in silence and the ceremony quietly stops doing what its author wrote. That is the failure this list exists to prevent, and it covers typos and removed fields alike rather than naming them one at a time.

Required keys are the subset in required_with_fields; the rest are optional. Nested keys are not listed: only the top level of the block is checked, because a nested shape belongs to the handler’s own params type.

pub fn reads_contract(self) -> ReadsContract

Returns the reads: inputs this action requires, and the groups from which exactly one input must be named.

A group is how an action offers two paths over the same operation. The input the author names selects the path, so naming both is ambiguous and naming neither leaves the path undetermined. The resolver reports either on the step.

pub fn describe(&self) -> &'static str

Short human-readable description of what this action does.

Used as fallback prose in script generation, TUI step display, and LSP hover when no explicit description or message parameter is present.

Trait Implementations

impl Clone for ActionType

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for ActionType

impl Debug for ActionType

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ActionType

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Display for ActionType

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for ActionType

impl Hash for ActionType

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for ActionType

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for ActionType

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for ActionType