Struct WrapKeyParams 

#[non_exhaustive]
pub struct WrapKeyParams {
    pub scheme: Option<WrapScheme>,
    pub expect_recipient: Option<String>,
}

Params for wrap_key action.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

scheme: Option<WrapScheme>

The wrapping scheme, defaulting to "CMS-AES-256-GCM".

Which encapsulation a scheme takes still follows the recipient key and is never an author’s choice. What the author does choose is where the blob is going: CMS carries its own algorithm identifiers and is what a ceremony archives, while the raw mechanisms are what a cloud KMS import accepts and describe nothing about themselves.

A raw scheme is a weaker record: rite verify cannot re-derive its algorithms from the artifact, and says so rather than reporting the wrap as checked.

The AES schemes wrap under a symmetric key the backend holds, so they are reachable only from a step reading wrapping_key:. They name the KEK size, because the RFC 3394 and RFC 5649 object identifiers are per-size and the output carries neither.

expect_recipient: Option<String>

The recipient’s expected fingerprint, "sha256:<hex>" over its SPKI DER, for a step that reads recipient:.

Declaring it is what turns the recorded recipient from “whatever key was present” into a value the ceremony committed to in advance. On mismatch the step fails: a key wrapped to the wrong recipient cannot be unwrapped again.

Trait Implementations

impl Clone for WrapKeyParams

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for WrapKeyParams

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for WrapKeyParams

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for WrapKeyParams

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for WrapKeyParams

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl Serialize for WrapKeyParams

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.