Enum ArtifactValue 

pub enum ArtifactValue {
    BackendKey {
        backend_name: String,
        key_id: KeyId,
        algorithm: KeyAlgorithm,
        public_key: Option<PublicKeyDer>,
        check_value: Option<KeyCheckValue>,
    },
    WrappedKey(WrappedKey),
    PublicKey(PublicKeyDer),
    Bytes(Vec<u8>),
    Text(String),
    Certificate(CertificateDer),
}

Runtime representation of an artifact.

Variants

BackendKey

Cryptographic key managed by a backend (software, HSM, YubiKey). The private key never leaves the backend - only references are stored.

Fields

backend_name: String

Name of the backend that owns this key (e.g., “software”, “yubikey1”).

key_id: KeyId

Backend-specific key identifier (opaque, e.g., UUID or “slot_9c”).

algorithm: KeyAlgorithm

Algorithm for type checking and evidence.

public_key: Option<PublicKeyDer>

Public key (None for non-exportable HSM keys).

check_value: Option<KeyCheckValue>

Key check value, for a symmetric key.

What the key answers to where a keypair is answered for by its public half. A ceremony reaches it as ${artifact.kek.kcv | hex}, which is how a custodian compares it against what the token shows.

WrappedKey(WrappedKey)

Wrapped key, with the scheme it was wrapped under and the algorithms the wrap actually used. The container follows the scheme; the OpenSSL backend produces a CMS ContentInfo.

PublicKey(PublicKeyDer)

Exported public key.

Bytes(Vec<u8>)

Binary content from files or inline data (documents, crypto materials). Used for hashing, cryptographic operations, and verification.

Text(String)

Display text for physical item references (USB drives, tamper bags, etc.). Used in messages and prompts when referencing physical objects.

Certificate(CertificateDer)

X.509 certificate. Stored as DER; displayed and serialized as PEM.

Implementations

impl ArtifactValue

pub fn serialize( &self, format: Option<&str>, ) -> Result<SerializedArtifact, String>

Serialize artifact to bytes with metadata.

Returns a SerializedArtifact containing both the serialized bytes and metadata (MIME type, file extension) appropriate for the format.

Applies sensible defaults if format is None, then validates strictly.

Supported formats by artifact type:

• WrappedKey: “der” (default), “pem”
• PublicKey: “pem” (default), “der”, “base64”
• RsaKeypair: “pem” (default), “der” (private key in PKCS#8)
• Other artifacts: text representation (format ignored)

MIME type references:

• application/pkcs7-mime: CMS/PKCS#7 (RFC 5273)
• application/pkcs8: PKCS#8 private keys (RFC 5958)
• application/x-pem-file: PEM-encoded files
• application/x-x509-ca-cert: X.509 certificates (Netscape)
• text/plain: Text artifacts

Returns an error if an unsupported format is specified.

Trait Implementations

impl Debug for ArtifactValue

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for ArtifactValue

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.